SCscalekit
Triggers

Generate a connection's signing secret

Changed on

Generates a random signing secret for a connection's webhook URL, stores it, and returns it in plain text together with the URL that carries it. Use this endpoint for a provider that sends no signature of its own (provides_bearer_secret is true on its triggers), after CreateTriggerIngressEndpoint. Pass the connection ID in the path; the body is empty. The provider presents the secret back on every event, in an Authorization: Bearer <secret> header, the X-Scalekit-Webhook-Secret header, or the final path segment of url_with_secret, and an event without it is rejected. The first call on an endpoint with no secret sets one. A call where a secret already exists starts a rotation rather than replacing it, exactly as SetTriggerSigningSecret does: both secrets are accepted until you confirm the rotation with ConfirmTriggerSigningSecretRotation, or for at most 24 hours. A provider that signs its own events takes its secret from its app configuration through SetTriggerSigningSecret instead, and is refused here. Returns the secret in plain text, url_with_secret, and the endpoint with its masked secret and rotation state. The plain-text secret appears only in this response and is never returned again; generate another if it is lost.

post/api/v1/connections/{connection_id}/trigger-ingress/signing-secret/generate

Request

Path parameters

connection_idstring required

The connection whose webhook URL receives the generated secret. Between 1 and 64 characters.

Request body

TriggerServiceGenerateTriggerSigningSecretBody required

Response

The generated secret in plain text, the webhook URL with the secret appended, and the endpoint's state, including whether a rotation is now in progress

signing_secretstring

The generated secret, in plain text. Returned only in this response and never again by any endpoint, nor written to a log. The provider presents it back on every event in exactly one of three ways: an Authorization: Bearer <secret> header, the X-Scalekit-Webhook-Secret header, or the final path segment of url_with_secret.

url_with_secretstring

endpoint.url with the secret appended as a final path segment. Paste this into the provider's console when the provider cannot send a custom header. It is as sensitive as signing_secret and is likewise returned only in this response.

Example response

{
  "endpoint": {
    "connection_id": "conn_28128748834787840",
    "id": "tie_28128748834787840",
    "masked_signing_secret": "************************a4f9",
    "signing_secret_configured": true,
    "url": "https://acme.scalekit.dev/triggers/v1/kq3T9vX2bL8mN4pR7sW1yZ"
  }
}

Changes