KIkit
Webhooks

Rotate a webhook endpoint secret

Changed on

Generates a new signing secret for the endpoint and returns it. The response is the only time the new secret appears in plaintext — store it securely.

To avoid dropping deliveries mid-rollout, the previous secret keeps verifying until the overlap window closes (the endpoint's previous_secret_expires_at). During the window every delivery is signed with both secrets, so the X-Kit-Signature header carries two v1 entries — see secret rotation.

Rotating again while a previous rotation's window is still open returns 409; pass force: true to rotate anyway and immediately expire the older secret. Once you've switched over, you can close the window early with Revoke the previous secret.

post/v4/webhook_endpoints/{id}/rotate_secret

Request

  • Base URL
    https://api.kit.com
  • URL
    https://api.kit.com/v4/webhook_endpoints/{id}/rotate_secret
  • Auth
    • API key in header X-Kit-Api-Key
    • or OAuth 2
      Authorization code: https://api.kit.com/v4/oauth/authorize
      Token URL: https://api.kit.com/v4/oauth/token

Path parameters

idinteger required

Request body

forceboolean

Rotating again while a previous rotation's overlap window is still open returns 409 (see the responses below). Pass true to rotate anyway, immediately expiring the older secret.

Response

Rotates the secret and returns the new one

Changes