Skip to main content
POST
Rotate a signing secret

Authorizations

Authorization
string
header
required

Partner API key. Send as Authorization: Bearer sss_pk_....

Path Parameters

id
string<uuid>
required

The subscription id.

Response

New secret issued — shown exactly once.

id
string<uuid>

The rotated subscription id.

secret
string

The new signing secret, prefixed sss_whsec_. Shown exactly once — only its hash is stored. Deliveries are signed with both the old and the new secret for 24 hours, then the old secret stops signing.

signatureHeader
string

Header name carrying the HMAC signature on every delivery.

previousSecretExpiresAt
string<date-time>

Until this instant deliveries are signed with BOTH secrets — accept either during the overlap.