---
title: "Rotate a webhook signing secret"
method: POST
path: "/v1/webhooks/{id}/signing-secret/rotate"
tags: ["Webhooks"]
---

# Rotate a webhook signing secret

`POST /v1/webhooks/{id}/signing-secret/rotate`

## Request

- Base URL: `https://smtpfa.st/api`
- URL: `https://smtpfa.st/api/v1/webhooks/{id}/signing-secret/rotate`
- Auth: HTTP bearer

Replace the signing secret. The new secret is in this response only, and every event sent after this call, retries included, is signed with it, so update your endpoint at once. Requires the webhook:write scope and an owner or admin.

## Path parameters

- `id` string, required

## Response `200`

The new secret

- object
  - `object` string
  - `id` string
  - `signing_secret` string

## Other responses

- `401`: Invalid or missing API key
- `403`: Forbidden - domain not verified or insufficient permissions
- `404`: Resource not found
- `429`: Rate limit exceeded - retry after the period indicated in the Retry-After header
- `500`: Internal server error

---

[API](https://skmtc.dev/smtpfa/apis/smtpfast-api.md) · [All operations](https://skmtc.dev/smtpfa/apis/smtpfast-api/llms.txt) · [OpenAPI document](https://skmtc.dev/smtpfa/apis/smtpfast-api/revisions/79dda742f53e?raw)