MillionSend Docs

Rotate a webhook's signing secret

POST
/webhooks/{id}/rotate

MillionSend extension. Mints a new signing secret (or takes the one in signing_secret) and returns it. For overlap_hours the previous secret keeps signing too: every delivery in that window carries both signatures, space-separated in webhook-signature, so the receiver can switch at any point without a gap. A second rotation inside the window replaces the previous secret.

Path Parameters

id*string
Formatuuid

Request Body

application/json
  1. body
signing_secret?string

New secret to sign with: whsec_ followed by base64 of 24-64 bytes. Omit to mint one.

overlap_hours?integer

Hours the previous secret keeps signing alongside the new one (default 24, max 72). Every delivery in the window carries both signatures, so a receiver holding either verifies; 0 drops the old secret at once.

Range0 <= value <= 72

Response Body

The new secret and when the previous one stops signing

application/json
  1. response
object*"webhook"
Value in"webhook"
id*string
Formatuuid
signing_secret*string
previous_secret_expires_at*string
Example Request
curl -X POST 'https://api.millionsend.com/webhooks/497f6eca-6276-4993-bfeb-53cbbbba6f08/rotate' \  -H 'Content-Type: application/json' \  -d '{}'
Example Response
{  "object": "webhook",  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "signing_secret": "string",  "previous_secret_expires_at": "string"}