TRtriggerdotdev
webhooks

Generate a webhook signing secret

Changed on

Generate a new signing secret for the endpoint, store it, and return it once. Use this for providers where you choose the secret, such as GitHub. It replaces the existing secret. Pass previousSecretTtlSeconds to keep accepting the old secret while you update the provider; without it, deliveries signed with the old secret fail verification straight away. Endpoints whose source verifies with a public key refuse this; set the provider's key with the set secret endpoint instead.

post/api/v1/webhooks/endpoints/{endpointId}/rotate-secret

Request

Request body

previousSecretTtlSecondsinteger

How long, in seconds, the secret being replaced keeps verifying deliveries (at most 7 days). Omit it or pass 0 to replace the secret immediately, for example when it leaked.

Example request

{
  "previousSecretTtlSeconds": 3600
}

Response

Successful request

idstring required

The endpoint's wh_ id.

secretSettrue required
secretstring required

The new signing secret. It is returned only in this response and can't be read again.

previousSecretExpiresAtstring date-time

When the replaced secret stops verifying deliveries. Absent when it was replaced immediately.

Example response

{
  "id": "wh_cm1a2b3c4d5e6f",
  "secret": "whsec_5f2b...",
  "previousSecretExpiresAt": "2026-10-21T12:00:00.000Z"
}

Changes