Rotate Webhook Signing Key
Webhooks
Rotate Webhook Signing Key
Generate or rotate the HMAC signing secret for a webhook endpoint. If the webhook already has a key, the existing key is moved into a ‘previous’ slot and remains valid for the overlap window (24H) during which deliveries carry both signatures. The new secret is returned exactly once.
POST
Rotate Webhook Signing Key
Authorizations
Bearer authentication with an API token
Path Parameters
The ID of the webhook to rotate the signing key for
Response
Success
Plaintext signing secret. Returned exactly once — store it now.
Opaque identifier for this key
When the previous key stops being valid. Empty on first generate.
Examples:
"2023-01-15T01:30:15.01Z"
"2024-12-25T12:00:00Z"
Related topics
Verifying Bastion webhook signaturesAPI authentication overviewList WebhooksCreate WebhookRegister Signing Key