---
title: "Rotate the webhook signing secret"
method: POST
path: "/api/webhooks/{id}/rotate-secret"
tags: ["Webhooks"]
---

# Rotate the webhook signing secret

`POST /api/webhooks/{id}/rotate-secret`

## Request

- Base URL: `https://api.sendly.now`
- URL: `https://api.sendly.now/api/webhooks/{id}/rotate-secret`
- Auth: one of:
  - HTTP bearer
  - API key in cookie `better-auth.session_token`
  - OAuth 2 (authorization code, authorization URL `https://app.sendly.now/api/auth/oauth2/authorize`, token URL `https://app.sendly.now/api/auth/oauth2/token`, scopes: `webhooks:write`)

Generate a new shared secret. Returns the new plaintext secret exactly once.

Requires the `webhooks:write` scope — Create, edit, and delete your webhook endpoints.

## Path parameters

- `id` string, uuid, required

## Response `200`

Secret rotated

- WebhookRotateSecretResponse: Response from POST /api/webhooks/{id}/rotate-secret — returns the new plaintext once.
  - `data` object, required
    - `id` string, uuid, required
    - `secret` string, required: New plaintext shared secret.
  - `success` true, required

## Other responses

- `400`: Validation error
- `401`: Unauthorized — missing or invalid auth
- `403`: Forbidden — insufficient permissions or project disabled
- `404`: Resource not found
- `429`: Rate limit or billing limit exceeded
- `500`: Internal server error

---

[API](https://skmtc.dev/sendly/apis/sendly-api.md) · [All operations](https://skmtc.dev/sendly/apis/sendly-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sendly/apis/sendly-api/revisions/ce7cfb7f7c7e?raw)