> ## Documentation Index
> Fetch the complete documentation index at: https://developers.kit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate a webhook endpoint secret

> Generates a new signing secret for the endpoint and returns it. **The response is the only time the new `secret` appears in plaintext** — store it securely.

To avoid dropping deliveries mid-rollout, the previous secret keeps verifying until the overlap window closes (the endpoint's `previous_secret_expires_at`). During the window every delivery is signed with both secrets, so the `X-Kit-Signature` header carries two `v1` entries — see [secret rotation](/webhooks/verifying-signatures#secret-rotation).

Rotating again while a previous rotation's window is still open returns `409`; pass `force: true` to rotate anyway and immediately expire the older secret. Once you've switched over, you can close the window early with [Revoke the previous secret](/api-reference/webhooks/revoke-the-previous-webhook-endpoint-secret).



## OpenAPI

````yaml /api-reference/v4.json post /v4/webhook_endpoints/{id}/rotate_secret
openapi: 3.0.3
info:
  title: Kit API
  version: '4.0'
servers:
  - url: https://api.kit.com
security: []
paths:
  /v4/webhook_endpoints/{id}/rotate_secret:
    post:
      tags:
        - Webhooks
      summary: Rotate a webhook endpoint secret
      description: >-
        Generates a new signing secret for the endpoint and returns it. **The
        response is the only time the new `secret` appears in plaintext** —
        store it securely.


        To avoid dropping deliveries mid-rollout, the previous secret keeps
        verifying until the overlap window closes (the endpoint's
        `previous_secret_expires_at`). During the window every delivery is
        signed with both secrets, so the `X-Kit-Signature` header carries two
        `v1` entries — see [secret
        rotation](/webhooks/verifying-signatures#secret-rotation).


        Rotating again while a previous rotation's window is still open returns
        `409`; pass `force: true` to rotate anyway and immediately expire the
        older secret. Once you've switched over, you can close the window early
        with [Revoke the previous
        secret](/api-reference/webhooks/revoke-the-previous-webhook-endpoint-secret).
      parameters:
        - name: id
          in: path
          required: true
          schema:
            type: integer
          example: 78
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                force:
                  type: boolean
                  description: >-
                    Rotating again while a previous rotation's overlap window is
                    still open returns `409` (see the responses below). Pass
                    `true` to rotate anyway, immediately expiring the older
                    secret.
            example:
              force: false
      responses:
        '200':
          description: Rotates the secret and returns the new one
          content:
            application/json:
              schema:
                type: object
                properties:
                  webhook_endpoint:
                    type: object
                    properties:
                      id:
                        type: integer
                      name:
                        type: string
                      url:
                        type: string
                      events:
                        type: array
                        items:
                          type: string
                      status:
                        type: string
                      source:
                        type: string
                      description:
                        type: string
                      created_by_app:
                        nullable: true
                      created_at:
                        type: string
                      previous_secret_expires_at:
                        type: string
                      secret:
                        type: string
                        description: >-
                          The new signing secret (`whsec_` prefix). **Returned
                          only in this response** — store it securely. The
                          previous secret keeps verifying deliveries until
                          `previous_secret_expires_at`.
                    required:
                      - id
                      - name
                      - url
                      - events
                      - status
                      - source
                      - description
                      - created_by_app
                      - created_at
                      - previous_secret_expires_at
                      - secret
                required:
                  - webhook_endpoint
              example:
                webhook_endpoint:
                  id: 66
                  name: My webhook
                  url: https://hooks.example.com/incoming
                  events:
                    - subscriber.created
                  status: active
                  source: creator
                  description: A test webhook
                  created_by_app: null
                  created_at: '2023-02-17T11:43:55Z'
                  previous_secret_expires_at: '2023-02-18T11:43:55Z'
                  secret: whsec_YOUR_SIGNING_SECRET_HERE
        '404':
          description: Returns a 404 when the provided id does not exist
          content:
            application/json:
              schema:
                type: object
                properties:
                  errors:
                    type: array
                    items:
                      type: string
                required:
                  - errors
              example:
                errors:
                  - Not Found
        '409':
          description: >-
            Returns 409 when the previous rotation's overlap window is still
            open
          content:
            application/json:
              schema:
                type: object
                properties:
                  errors:
                    type: array
                    items:
                      type: string
                required:
                  - errors
              example:
                errors:
                  - >-
                    The previous signing secret is still within its rotation
                    window.
      security:
        - API Key: []
        - OAuth2: []
components:
  securitySchemes:
    API Key:
      description: Authenticate API requests via an API Key
      type: apiKey
      in: header
      name: X-Kit-Api-Key
    OAuth2:
      description: Authenticate API requests via an OAuth token
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://api.kit.com/v4/oauth/authorize
          tokenUrl: https://api.kit.com/v4/oauth/token
          refreshUrl: https://api.kit.com/v4/oauth/token
          scopes:
            read: Read access to Kit API v4
            write: Write access to Kit API v4

````

## Related topics

- [Get a webhook endpoint](/api-reference/webhooks/get-a-webhook-endpoint.md)
- [Create a webhook endpoint](/api-reference/webhooks/create-a-webhook-endpoint.md)
- [Revoke the previous webhook endpoint secret](/api-reference/webhooks/revoke-the-previous-webhook-endpoint-secret.md)
- [Verifying signatures](/webhooks/verifying-signatures.md)
- [Upgrading to V4](/api-reference/upgrading-to-v4.md)