---
title: "Rotate webhook subscription secret"
method: POST
path: "/1.0/webhook_subscriptions/{subscriptionId}/actions/rotateSecret"
tags: ["WebhookSubscriptions"]
---

# Rotate webhook subscription secret

`POST /1.0/webhook_subscriptions/{subscriptionId}/actions/rotateSecret`

## Request

- Base URL: `https://api.squarespace.com`
- URL: `https://api.squarespace.com/1.0/webhook_subscriptions/{subscriptionId}/actions/rotateSecret`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/squarespace/apis/commerce-api/docs/1.0/webhook_subscriptions/:subscriptionId/actions/rotateSecret/post.ts> (a function with typed inputs; its response is checked against the schema)

Rotates a webhook subscription's secret. The previous secret for a subscription is no longer valid after a new one is generated. Requires an OAuth access token; API keys are not supported.

## Path parameters

- `subscriptionId` string, required

## Headers

- `Authorization` string, required
- `User-Agent` string, required

## Response `200`

OK

- ExternalRotateSecretResponse
  - `secret` string: Hexadecimal value used to generate a signature for a webhook notification; field is only returned when creating a new subscription or rotating a secret. Store the secret in a safe location to verify notifications from Squarespace.

## Other responses

- `404`: The requested Webhook Subscription was not found.

---

[API](https://skmtc.dev/squarespace/apis/commerce-api.md) - [All operations](https://skmtc.dev/squarespace/apis/commerce-api/llms.txt) - [OpenAPI document](https://skmtc.dev/squarespace/apis/commerce-api/revisions/5dd4b1b7cd38?raw)