---
title: "Rotate Trigger Signing Secret"
method: POST
path: "/api/v1/triggers/{trigger_id}/signing-secret"
tags: ["Triggers"]
---

# Rotate Trigger Signing Secret

`POST /api/v1/triggers/{trigger_id}/signing-secret`

## Request

- The document declares no server URL.
- Auth: one of:
  - OAuth 2
    - Password
    - Token URL: `api/v1/login`
  - API key in query parameter `x-api-key`
  - API key in header `x-api-key`

Mint this trigger's ingress address and signing secret, or rotate them.

Rotation replaces the stored secret, so the previous one stops verifying on
the next delivery: there is no grace window, deliberately. A webhook secret
is rotated because it leaked, and a grace window is exactly the period the
leak is still useful.

The address (``public_id``) is minted once and kept across rotations, so
rotating a secret does not require reconfiguring the caller's URL.

## Path parameters

- `trigger_id` string, uuid, required

## Response `200`

Successful Response

- TriggerSigningSecretRead: The one response that carries a signing secret, on the way out. Nothing reads the secret back: the stored form is encrypted, the GET route reports only whether one is set, and a lost secret is rotated rather than recovered.
  - `has_signing_secret` boolean, required
  - `ingress_url` string, nullable, required
  - `public_id` string, nullable, required
  - `signing_secret` string, required
  - `trigger_id` string, uuid, required

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-21** `4349fbe90c64`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/langflow-ai/apis/langflow/changes/api/v1/triggers/:trigger_id/signing-secret/post.md)

---

[API](https://skmtc.dev/langflow-ai/apis/langflow.md) - [All operations](https://skmtc.dev/langflow-ai/apis/langflow/llms.txt) - [OpenAPI document](https://skmtc.dev/langflow-ai/apis/langflow/revisions/4349fbe90c64?raw)