---
title: "Rotate the webhook signing secret"
method: POST
path: "/users/me/webhook-secret/rotate"
tags: ["users"]
---

# Rotate the webhook signing secret

`POST /users/me/webhook-secret/rotate`

## Request

- Base URL: `https://api.sytecheck.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.sytecheck.app/users/me/webhook-secret/rotate`
- Auth: HTTP bearer

Issue a new webhook signing secret. **The previous secret stops working
immediately — there is no overlap window**, so update your receiver first.

Requires an interactive session and a plan that includes webhooks.

## Response `200`

Successful Response

- WebhookSecretResponse: An account's outbound webhook signing secret. Returned in full on every read, unlike an API key, and the difference is deliberate. A key is a *bearer* credential — anyone holding it can act as the account, so it is stored hashed and shown once. This secret grants no access to anything: it only lets the holder verify that a delivery came from us. The cost of showing it again is therefore low, and the cost of *not* showing it is high — a customer who loses it would otherwise have to rotate, breaking a working integration to recover a value we can simply re-derive.
  - `secret` string, required: The signing secret, as `whsec_<hex>`. Configure it in the receiver that verifies the `X-SyteCheck-Signature` header.
  - `version` integer, required: Rotation counter. Rotating issues a new secret and immediately invalidates the previous one, so update the receiver first.
  - `signature_max_age_seconds` integer, required: How old a signed timestamp may be before a receiver should reject the delivery as a replay.

---

[API](https://skmtc.dev/sytecheck/apis/sytecheck-api.md) · [All operations](https://skmtc.dev/sytecheck/apis/sytecheck-api/llms.txt) · [OpenAPI document](https://skmtc.dev/sytecheck/apis/sytecheck-api/revisions/797cf6b3e867?raw)