Rotate webhook signing secret
POST
/v1/webhooks/{webhook_id}/rotate-secret
bird webhooks rotate-secret <webhook-id> --yescurl -X POST "https://us1.platform.bird.com/v1/webhooks/{webhook_id}/rotate-secret" \
-H "Authorization: Bearer $TOKEN"Response200
{
"secret": "whsec_newbase64encodedvalue"
}
Generates a new signing secret for the endpoint and returns it exactly once: store it
immediately, it cannot be retrieved after this response. For 24 hours every delivery
is signed with both the old and the new secret, so a receiver verifying with either
keeps working while you roll the new one out. After the window the old secret stops
signing. Verification details are in the webhooks guide.
An endpoint holds at most 5 concurrently valid secrets, so rotating repeatedly within
the overlap window fails with WebhookTooManySecrets until an older secret expires.
Parameters
webhook_id
string
ID of the webhook endpoint (whk_ prefix), as returned when it was created.
Response Payload
secret
string
required
The new signing secret (whsec_ prefix). Shown only in this response: store it immediately, it cannot be retrieved again. Deliveries are signed with both this and the previous secret for 24 hours after rotation, then the previous secret stops signing.