---
title: "Create a signing secret"
method: POST
path: "/v1/webhooks/{id}/secrets"
tags: ["Webhooks"]
---

# Create a signing secret

`POST /v1/webhooks/{id}/secrets`

## Request

- Base URL: `https://api.sendora.se`
- URL: `https://api.sendora.se/v1/webhooks/{id}/secrets`
- Auth: HTTP bearer

Adds a second live secret to the webhook and answers its value once; it is never shown again. From then on every delivery carries one signature per live secret, the newest first, so the receiver can switch to the new secret and the old one can be deleted. A webhook holds at most two live secrets.

## Path parameters

- `id` string, uuid, required

## Response `201`

The new secret, its value shown this once.

- object: The new secret, its value shown this once.
  - `secretId` string, uuid, required
  - `createdAt` string, date-time, required
  - `secret` string, required: The secret itself, shown this once.

## Other responses

- `401`: The key is missing, malformed or revoked.
- `403`: The key is of the other kind, or a connected app may not do this here: it is not for connections, the connection may only read here, or it is for test servers only.
- `404`: No such webhook of this server.
- `409`: The webhook already holds two live secrets: one in use and one to roll to. Delete one before creating another.

---

[API](https://skmtc.dev/sendora/apis/sendora-api.md) · [All operations](https://skmtc.dev/sendora/apis/sendora-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sendora/apis/sendora-api/revisions/72efbbb34b64?raw)