Webhooks

Rotate a webhook signing secret

Mint a fresh signing secret. The new plaintext is returned EXACTLY ONCE, here — no endpoint reads it back, so a secret you lose is replaced by rotating again rather than recovered.

Rotation overlaps on purpose. The outgoing secret keeps verifying until previous_secret_expires_at, and every delivery inside that window carries BOTH signatures in the webhook-signature header — so you can deploy the new secret to your verifier whenever you like without dropping an in-flight event. Rotating twice inside the window discards the older secret: only one previous secret is ever live.

url, event_types and status are unchanged.

Requires the webhooks:write scope — Create, edit, and delete your webhook endpoints.

post/api/v1/webhooks/{id}/rotate-secret

Request

  • Base URL: https://api.sendly.now
  • URL: https://api.sendly.now/api/v1/webhooks/{id}/rotate-secret
  • Auth: one of:
    • HTTP bearer
    • API key in cookie better-auth.session_token
    • OAuth 2 (authorization code, authorization URL https://app.sendly.now/api/auth/oauth2/authorize, token URL https://app.sendly.now/api/auth/oauth2/token, scopes: webhooks:write)

Path parameters

idstring uuid required

Resource id.

Response

The new signing secret and the moment the previous one stops verifying

previous_secret_expires_atstring date-time required

When the PREVIOUS secret stops verifying. Until then every delivery carries both signatures, so a consumer can redeploy its verifier without dropping an event.

secretstring required

The new signing secret, shown EXACTLY ONCE. Store it now — no endpoint returns it again.

Changes

No recorded changes to this operation across all 1 revision of this API.