post

Generates a new HMAC-SHA256 signing secret. Update your verification code immediately — deliveries are signed with the new secret starting with this call, with no grace period for signature verification.

The 24-hour window that follows rotation is for undoing the rotation only, not for continued verification against the old secret: if you rotated by mistake, call POST /{webhook}/actions/revertSecret within that window to restore the previous secret. After 24 hours the previous secret is discarded.

The new secret is returned once in the response and is never stored in plaintext after that. If lost, rotate again.

Required role

affiliate_super_admin

Response 200

{
  "credentials": "a3f2...64hexchars",
  "previousCredentialsExpiresAt": "2026-05-31T14:00:00.000Z"
}

previousCredentialsExpiresAt is the UTC timestamp until which you can call revertSecret to restore the previous secret — it does not mean the previous secret remains valid for verification.