Pre-1.0 · one maintainer · Stripe and cards only · no SDKs (client libraries) yet · no production users yet. Docs describe v0.9.1 (29 Oct 2026) · What’s new →
Rotate signing secret (72h dual-signing grace)
POST
/v1/webhook-endpoints/endpoints/{id}/rotate-secret
const url = 'http://localhost:8080/v1/webhook-endpoints/endpoints/example/rotate-secret';const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
try { const response = await fetch(url, options); const data = await response.json(); console.log(data);} catch (error) { console.error(error);}curl --request POST \ --url http://localhost:8080/v1/webhook-endpoints/endpoints/example/rotate-secret \ --header 'Authorization: Bearer <token>'Authorizations
Section titled “Authorizations”Parameters
Section titled “Parameters”Path Parameters
Section titled “Path Parameters”id
required
string
Header Parameters
Section titled “Header Parameters”Idempotency-Key
string
Makes the call safe to retry. Send a unique value (a UUID works) and
the same value on every retry. For 24 hours, a repeat with the same
key, method, path and body gets the first response again, with an
Idempotent-Replayed: true header, instead of running again. The
error cases are in docs/api-surface.md. The usage routes do not take
it: each usage event carries its own idempotency_key.
Responses
Section titled “Responses”New secret (old secret keeps verifying during the grace window)
Media typeapplication/json
The endpoint’s new signing secret. It is shown only here.
object
secret
required
string
secondary_valid_until
Until this time, deliveries are also signed with the old secret.
string format: date-time
Example generated
{ "secret": "example", "secondary_valid_until": "2026-04-15T12:00:00Z"}