Skip to main content
POST
Generates a signing secret for an existing webhook, or replaces it with the signing_secret you supply. A supplied secret must contain at least 16 characters. The secret is returned once in data.signing_secret; store it securely, since it cannot be read back. Rotation takes effect immediately. If you supply your own secret, configure your receiver to accept it before making this call. See Secret rotation.
To enable signing when creating a webhook, use generate_signing_secret: true on Register Webhook. If no webhook is registered, this endpoint returns 404.

Authorizations

Authorization
string
header
required

Send your API key as Authorization: Bearer <your_api_key>.

Body

application/json

Omit the body to have a secret generated for you

signing_secret
string

Secret for signing webhook deliveries, at least 16 characters. Omit it or send null to generate one.

Example:

"whsec_EXAMPLE_ONLY_THIS_IS_NOT_A_REAL_SIGNING_KEY"

Response

OK

data
object
Example:
error
Error details · object | null

Error details on failure, or null on success.

Example:

null

meta
object
Example:
success
boolean

Whether the request succeeded.

Example:

true