Rotate the secret

Replace a webhook endpoint's signing secret. The new secret applies at once, with no grace period.

POST{BASE_URL}/webhooks/{id}/secret

Issues a new signing secret for the endpoint and returns it. Requires a provider key; the partner header is ignored. Send no body.

There is no grace period

From the moment this call returns, every delivery is signed with the new secret, and the old one no longer verifies. Deploy the new secret to your receiver straight away. Deliveries that fail verification in between are retried for about five minutes — and you can replay any that failed for good.

Path parameters

idstringrequired: The endpoint's ID.

Response

dataobjectrequired: The webhook endpoint with its new secretPreview and secretRotatedAt, plus secret.
data.secretstringrequired: The new signing secret.

Status codes#

Status	Code	Meaning
`200`	—	Rotated.
`403`	`provider_key_required`	A partner key made the call.
`404`	`webhook_endpoint_not_found`	You have no endpoint with that ID.

curl -X POST "$LOCALOY_BASE_URL/webhooks/cm8wh00k0000000000000001/secret" \
  -H "Authorization: Bearer $LOCALOY_PROVIDER_KEY"

Response · 200

{
  "success": true,
  "message": "Signing secret rotated. Deliveries are signed with the new secret from now on — the previous one no longer verifies.",
  "data": {
    "id": "cm8wh00k0000000000000001",
    "url": "https://hooks.example.com/localoy",
    "secretPreview": "whsec_Tq4nW8…",
    "secretRotatedAt": "2026-09-27T16:10:00.512Z",
    "…": "…",
    "secret": "whsec_Tq4nW8cFz1Lp6Hs3Ud9Ym2Kb5Vx7Rj0Ne4Ga8Qw1IoP"
  }
}