Rotate a webhook secret

POST/v1/webhooks/{id}/rotate-secretAPI key

Generates a new secret and returns it once. The old secret stops working straight away: every delivery from now on, including retries of earlier events, is signed with the new secret only. Update the secret in your endpoint right after calling this, or signature checks will fail until you do.

If you can't update your endpoint at the same moment, accept both secrets there for a short while: check the signature against the new one, and fall back to the old one.

Path parameters

idstringpathrequired

The webhook ID.

Response

The webhook, with the new secret. Same fields as Create a webhook.

secretstring

The new signing secret, whsec_ followed by 32 letters and digits.

Errors

Status	Code	When
404	`webhook_not_found`	No webhook with this ID in the project.

Request

import { Flaresend } from '@flaresend/client';

const flaresend = new Flaresend({
  apiKey: process.env.FLARESEND_API_KEY!,
  baseUrl: 'https://mailer.example.com',
});

const { secret } = await flaresend.webhooks.rotateSecret('wh_01K6B3C8R2M5T7V9X1Z3B5D7F9');

Response

{
  "id": "wh_01K6B3C8R2M5T7V9X1Z3B5D7F9",
  "projectId": "proj_01K6A9W2E4R6T8Y0U2I4O6P8A0",
  "url": "https://acme.com/webhooks/flaresend",
  "events": ["*"],
  "enabled": true,
  "createdAt": "2026-09-26T10:00:00.000Z",
  "updatedAt": "2026-09-27T08:15:00.000Z",
  "secret": "whsec_9Tb3Nq7Wk1Rz5Hc2Lm8Pv4Xy6Ja0Ds3F"
}

Path parametersCopy Anchor Link

ResponseCopy Anchor Link

ErrorsCopy Anchor Link

Path parameters

Response

Errors