---
title: "Rotate the webhook signing secret"
method: POST
path: "/credits/tenants/me/webhook-secret/rotate"
tags: ["Webhooks"]
---

# Rotate the webhook signing secret

`POST /credits/tenants/me/webhook-secret/rotate`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/tenants/me/webhook-secret/rotate`
- Auth: HTTP bearer

Returns the new secret once. Requires a workspace owner or admin with credentials:manage and MFA or passkey step-up completed in the last ten minutes. Deliveries contain signatures for both the current and previous secrets during a 24-hour overlap.

## Headers

- `X-Locus-Step-Up` string, password

## Response `200`

New signing secret and old-secret expiry

- object
  - `success` unknown, required
  - `webhook_secret` string, required
  - `previous_secret_valid_until` string, date-time, required

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)