> ## Documentation Index
> Fetch the complete documentation index at: https://trigger.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate a webhook signing secret

> Generate a new signing secret for the endpoint, store it, and return it once. Use this for providers where you choose the secret, such as GitHub. It replaces the existing secret. Pass `previousSecretTtlSeconds` to keep accepting the old secret while you update the provider; without it, deliveries signed with the old secret fail verification straight away. Endpoints whose source verifies with a public key refuse this; set the provider's key with the set secret endpoint instead.



## OpenAPI

````yaml v3-openapi POST /api/v1/webhooks/endpoints/{endpointId}/rotate-secret
openapi: 3.1.0
info:
  title: Trigger.dev v3 REST API
  description: >-
    The REST API lets you trigger and manage runs on Trigger.dev. You can
    trigger a run, get the status of a run, and get the results of a run. 
  version: 2024-04
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
servers:
  - url: https://api.trigger.dev
    description: Trigger.dev API
security: []
paths:
  /api/v1/webhooks/endpoints/{endpointId}/rotate-secret:
    parameters:
      - $ref: '#/components/parameters/webhookEndpointId'
    post:
      tags:
        - webhooks
      summary: Generate a webhook signing secret
      description: >-
        Generate a new signing secret for the endpoint, store it, and return it
        once. Use this for providers where you choose the secret, such as
        GitHub. It replaces the existing secret. Pass `previousSecretTtlSeconds`
        to keep accepting the old secret while you update the provider; without
        it, deliveries signed with the old secret fail verification straight
        away. Endpoints whose source verifies with a public key refuse this; set
        the provider's key with the set secret endpoint instead.
      operationId: rotate_webhook_endpoint_secret_v1
      requestBody:
        required: false
        content:
          application/json:
            schema:
              type: object
              properties:
                previousSecretTtlSeconds:
                  $ref: '#/components/schemas/WebhookPreviousSecretTtlSeconds'
      responses:
        '200':
          description: Successful request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RotateWebhookEndpointSecretResponse'
        '400':
          description: >-
            The endpoint's source verifies with a public key, so a secret can't
            be generated, or the body is invalid
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized request
        '404':
          description: Endpoint not found
      security:
        - secretKey: []
      x-codeSamples:
        - lang: curl
          label: Generate a signing secret
          source: >-
            curl -X POST
            "https://api.trigger.dev/api/v1/webhooks/endpoints/github/rotate-secret"
            \
              -H "Authorization: Bearer $TRIGGER_SECRET_KEY" \
              -H "Content-Type: application/json" \
              -d '{ "previousSecretTtlSeconds": 3600 }'
components:
  parameters:
    webhookEndpointId:
      in: path
      name: endpointId
      required: true
      schema:
        type: string
      description: >-
        The endpoint's declared id (the `id` passed to
        `webhooks.endpoint.define`) or its `wh_` id. A value starting with `wh_`
        is always a generated id, since declared ids can't start with `wh_`. A
        declared id names the endpoint's declared instance in the key's
        environment.
      example: stripe
  schemas:
    WebhookPreviousSecretTtlSeconds:
      type: integer
      minimum: 0
      maximum: 604800
      description: >-
        How long, in seconds, the secret being replaced keeps verifying
        deliveries (at most 7 days). Omit it or pass 0 to replace the secret
        immediately, for example when it leaked.
      example: 3600
    RotateWebhookEndpointSecretResponse:
      type: object
      required:
        - id
        - secretSet
        - secret
      properties:
        id:
          type: string
          description: The endpoint's `wh_` id.
          example: wh_cm1a2b3c4d5e6f
        secretSet:
          type: boolean
          const: true
        secret:
          type: string
          description: >-
            The new signing secret. It is returned only in this response and
            can't be read again.
          example: whsec_5f2b...
        previousSecretExpiresAt:
          type: string
          format: date-time
          description: >-
            When the replaced secret stops verifying deliveries. Absent when it
            was replaced immediately.
          example: '2026-10-21T12:00:00.000Z'
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          example: Something went wrong
      required:
        - error
  securitySchemes:
    secretKey:
      type: http
      scheme: bearer
      description: >
        Use a named environment API key. It starts with `tr_dev_sk_`,
        `tr_prod_sk_`, `tr_stg_sk_`, etc.


        Create a named API key in the API Keys section of your Trigger.dev
        project dashboard. Choose the narrowest access preset that supports your
        integration.


        Our TypeScript SDK will default to using the value of the
        `TRIGGER_SECRET_KEY` environment variable if it is set. If you are using
        the SDK in a different environment, you can set the key using the
        `configure` function.


        ```typescript

        import { configure } from "@trigger.dev/sdk";


        configure({ accessToken: "tr_dev_sk_1234" });

        ```

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.