---
title: "Adds a new active signing secret."
method: POST
path: "/api/v1/orgs/{org}/webhooks/{id}/secrets"
tags: ["Webhooks"]
---

# Adds a new active signing secret.

`POST /api/v1/orgs/{org}/webhooks/{id}/secrets`

## Request

- Base URL: `https://api.featureflip.io`
- URL: `https://api.featureflip.io/api/v1/orgs/{org}/webhooks/{id}/secrets`
- Auth: API key in header `Authorization`

Requires Admin. The previous secret keeps signing until
you retire it, so receivers can switch over without dropping deliveries. The response
carries the new secret, which is never shown again. Supports the `Idempotency-Key`
header.

## Path parameters

- `org` string, required
- `id` string, required

## Response `201`

Created

- PublicRotateWebhookSecretResponse: A newly added signing secret. The secret is shown only here.
  - `secretId` string, uuid, required
  - `secret` string, nullable, required
  - `warning` string, nullable, required

## Other responses

- `400`: The request is malformed, or it carries an If-Match header, which this endpoint can't evaluate. Send no If-Match, or `*`.
- `401`: Authentication is required, or the supplied API token is invalid or expired.
- `403`: Forbidden
- `404`: Not Found
- `429`: Rate limit exceeded. Retry after the interval indicated by the Retry-After header.

---

[API](https://skmtc.dev/featureflip/apis/management-api.md) · [All operations](https://skmtc.dev/featureflip/apis/management-api/llms.txt) · [OpenAPI document](https://skmtc.dev/featureflip/apis/management-api/revisions/8a77e8581a45?raw)