---
title: "Generate a webhook signing secret"
method: POST
path: "/api/v1/webhooks/endpoints/{endpointId}/rotate-secret"
tags: ["webhooks"]
---

# Generate a webhook signing secret

`POST /api/v1/webhooks/endpoints/{endpointId}/rotate-secret`

## Request

- Base URL: `https://api.trigger.dev`
- URL: `https://api.trigger.dev/api/v1/webhooks/endpoints/{endpointId}/rotate-secret`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/triggerdotdev/apis/trigger-dev-v3-rest-api/docs/api/v1/webhooks/endpoints/:endpointId/rotate-secret/post.ts> (a function with typed inputs; its response is checked against the schema)

Generate a new signing secret for the endpoint, store it, and return it once. Use this for providers where you choose the secret, such as GitHub. It replaces the existing secret. Pass `previousSecretTtlSeconds` to keep accepting the old secret while you update the provider; without it, deliveries signed with the old secret fail verification straight away. Endpoints whose source verifies with a public key refuse this; set the provider's key with the set secret endpoint instead.

## Request body

- object
  - `previousSecretTtlSeconds` integer: How long, in seconds, the secret being replaced keeps verifying deliveries (at most 7 days). Omit it or pass 0 to replace the secret immediately, for example when it leaked.

## Response `200`

Successful request

- RotateWebhookEndpointSecretResponse
  - `id` string, required: The endpoint's `wh_` id.
  - `secretSet` true, required
  - `secret` string, required: The new signing secret. It is returned only in this response and can't be read again.
  - `previousSecretExpiresAt` string, date-time: When the replaced secret stops verifying deliveries. Absent when it was replaced immediately.

## Other responses

- `400`: The endpoint's source verifies with a public key, so a secret can't be generated, or the body is invalid
- `401`: Unauthorized request
- `404`: Endpoint not found

## Changes

- **2026-10-21** `441161111493`: 2 info
  - added optional request body
  - added the optional property `previousSecretExpiresAt` to the response with the `200` status
- **2026-10-15** `f44b1ec886c8`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/triggerdotdev/apis/trigger-dev-v3-rest-api/changes/api/v1/webhooks/endpoints/:endpointId/rotate-secret/post.md)

---

[API](https://skmtc.dev/triggerdotdev/apis/trigger-dev-v3-rest-api.md) - [All operations](https://skmtc.dev/triggerdotdev/apis/trigger-dev-v3-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/triggerdotdev/apis/trigger-dev-v3-rest-api/revisions/441161111493?raw)