---
title: "Rotate Webhook Signing Secret"
method: POST
path: "/v1/webhooks/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate Webhook Signing Secret

`POST /v1/webhooks/{id}/rotate-secret`

## Request

- Base URL: `https://api.anchorbrowser.io`
- URL: `https://api.anchorbrowser.io/v1/webhooks/{id}/rotate-secret`
- Auth: API key in header `anchor-api-key`

Mint a new HMAC-SHA256 signing secret. The previous secret remains valid
for 24 hours so you can update your verification code at your own pace,
then drop the old secret.

The new secret is returned exactly once, in the `secret` field.

## Path parameters

- `id` string, required

## Response `200`

New signing secret issued.

- WebhookWithSecret: A registered webhook subscription. The signing secret is NEVER returned by GET/list endpoints.
  - `id` string, required: Webhook id. Use as the path parameter on subsequent calls.
  - `project_id` string, uuid, required: The project (team) the webhook belongs to.
  - `url` string, uri, required: HTTPS URL Anchor will POST events to.
  - `description` string, nullable, required: Optional human-readable description.
  - `subscribed_events` WebhookEventType[], required: Event types this webhook is currently subscribed to.
  - `enabled` boolean, required: When `false`, no events fan out to this webhook.
  - `created_at` string, date-time, nullable, required
  - `updated_at` string, date-time, nullable, required
  - `secret` string, required: HMAC-SHA256 signing secret. Use this to verify the `Anchor-Signature` header on each delivery.

## Other responses

- `404`: Webhook not found in this project.
- `500`: Failed to rotate secret.

## Changes

- **2026-10-16** `b3bfdb98c79e`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/anchorbrowser/apis/anchorbrowser-api/changes/v1/webhooks/:id/rotate-secret/post.md)

---

[API](https://skmtc.dev/anchorbrowser/apis/anchorbrowser-api.md) - [All operations](https://skmtc.dev/anchorbrowser/apis/anchorbrowser-api/llms.txt) - [OpenAPI document](https://skmtc.dev/anchorbrowser/apis/anchorbrowser-api/revisions/9d755f22df0e?raw)