---
title: "Replace the signing secret"
method: POST
path: "/v1/webhook/secret"
tags: ["Webhooks"]
---

# Replace the signing secret

`POST /v1/webhook/secret`

## Request

- Base URL: `https://api.tessio.eu`
- URL: `https://api.tessio.eu/v1/webhook/secret`
- Auth: HTTP bearer

Mints a new signing secret and returns it once. Deliveries are signed when they are sent, so this applies to anything already queued as well as to new events: until you install the new secret, every delivery fails your `X-Tessio-Signature` check. Setting the endpoint does NOT do this, so correcting a URL is safe.

## Response `200`

Replaced (new secret returned once)

- WebhookSecret
  - `secret` string: The new signing secret (whsec_…), shown once

## Other responses

- `401`: Missing / invalid / revoked key
- `403`: insufficient_scope. The key is valid but may only read stats (`stats:read`), so it cannot call this route. Use a project's key with scope `full`.
- `404`: No endpoint configured

---

[API](https://skmtc.dev/tessio/apis/tessio-cloud-api.md) · [All operations](https://skmtc.dev/tessio/apis/tessio-cloud-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tessio/apis/tessio-cloud-api/revisions/536b3f4769fb?raw)