---
title: "Set a webhook signing secret"
method: PUT
path: "/api/v1/webhooks/endpoints/{endpointId}/secret"
tags: ["webhooks"]
---

# Set a webhook signing secret

`PUT /api/v1/webhooks/endpoints/{endpointId}/secret`

## Request

- Base URL: `https://api.trigger.dev`
- URL: `https://api.trigger.dev/api/v1/webhooks/endpoints/{endpointId}/secret`
- Auth: HTTP bearer
- TypeScript: <https://skmtc.dev/triggerdotdev/apis/trigger-dev-v3-rest-api/docs/api/v1/webhooks/endpoints/:endpointId/secret/put.ts> (a function with typed inputs; its response is checked against the schema)

Store the signing secret or public key the provider issued for this endpoint, such as the `whsec_` secret Stripe returns when you create a webhook endpoint. It replaces the existing secret. Pass `previousSecretTtlSeconds` to keep accepting the old secret for a while, for example while the provider rolls its secret.

## Request body

- object
  - `secret` string, required: The signing secret or public key. Leading and trailing whitespace is trimmed.
  - `previousSecretTtlSeconds` integer: How long, in seconds, the secret being replaced keeps verifying deliveries (at most 7 days). Omit it or pass 0 to replace the secret immediately, for example when it leaked.

## Response `200`

Successful request

- SetWebhookEndpointSecretResponse
  - `id` string, required: The endpoint's `wh_` id.
  - `secretSet` true, required
  - `previousSecretExpiresAt` string, date-time: When the replaced secret stops verifying deliveries. Absent when it was replaced immediately.

## Other responses

- `400`: Invalid request body
- `401`: Unauthorized request
- `404`: Endpoint not found

## Changes

- **2026-10-21** `441161111493`: 2 info
  - added the new optional request property `previousSecretTtlSeconds`
  - added the optional property `previousSecretExpiresAt` to the response with the `200` status
- **2026-10-15** `f44b1ec886c8`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/triggerdotdev/apis/trigger-dev-v3-rest-api/changes/api/v1/webhooks/endpoints/:endpointId/secret/put.md)

---

[API](https://skmtc.dev/triggerdotdev/apis/trigger-dev-v3-rest-api.md) - [All operations](https://skmtc.dev/triggerdotdev/apis/trigger-dev-v3-rest-api/llms.txt) - [OpenAPI document](https://skmtc.dev/triggerdotdev/apis/trigger-dev-v3-rest-api/revisions/441161111493?raw)