Skip to main content

Rotate the signing secret

POST 
/openapi/v1/webhooks/:webhookId/rotate

Generate a fresh HMAC signing secret and return it ONCE. Save the returned value — there is no API to recover it. Rotation keeps the superseded secret alive for a configurable overlap window (default 24h): during the window every delivery is signed with BOTH secrets (two v1= entries in X-Oho-Signature), so a receiver still verifying with the old secret keeps working until it rolls to the new one. After the window the old secret is no longer honoured.

Request​

Responses​

OK