---
title: "Rotate a webhook signing secret"
method: POST
path: "/api/v1/webhooks/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate a webhook signing secret

`POST /api/v1/webhooks/{id}/rotate-secret`

## Request

- Base URL: `https://api.sendly.now`
- URL: `https://api.sendly.now/api/v1/webhooks/{id}/rotate-secret`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `better-auth.session_token`
  - OAuth 2 (authorization code, authorization URL `https://app.sendly.now/api/auth/oauth2/authorize`, token URL `https://app.sendly.now/api/auth/oauth2/token`, scopes: `webhooks:write`)

Mint a fresh signing secret. The new plaintext is returned EXACTLY ONCE, here — no endpoint reads it back, so a secret you lose is replaced by rotating again rather than recovered.

Rotation overlaps on purpose. The outgoing secret keeps verifying until `previous_secret_expires_at`, and every delivery inside that window carries BOTH signatures in the `webhook-signature` header — so you can deploy the new secret to your verifier whenever you like without dropping an in-flight event. Rotating twice inside the window discards the older secret: only one previous secret is ever live.

`url`, `event_types` and `status` are unchanged.

Requires the `webhooks:write` scope — Create, edit, and delete your webhook endpoints.

## Path parameters

- `id` string, uuid, required: Resource id.

## Response `200`

The new signing secret and the moment the previous one stops verifying

- WebhookV1SecretRotated: A freshly rotated signing secret, and the moment the outgoing one stops verifying.
  - `previous_secret_expires_at` string, date-time, required: When the PREVIOUS secret stops verifying. Until then every delivery carries both signatures, so a consumer can redeploy its verifier without dropping an event.
  - `secret` string, required: The new signing secret, shown EXACTLY ONCE. Store it now — no endpoint returns it again.

## Other responses

- `401`: `invalid_api_key` or `invalid_session` — missing or invalid credentials.
- `403`: `scope_missing`, `project_access_denied`, or `project_disabled`.
- `404`: `resource_not_found` — no webhook with this id belongs to the authenticated project.
- `422`: `validation_error` — query, path, or body parameters did not match the schema.
- `429`: `rate_limited` — see `Retry-After` and the `RateLimit` headers.
- `500`: `internal_error`.

---

[API](https://skmtc.dev/sendly/apis/sendly-api.md) · [All operations](https://skmtc.dev/sendly/apis/sendly-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sendly/apis/sendly-api/revisions/ce7cfb7f7c7e?raw)