> ## Documentation Index
> Fetch the complete documentation index at: https://trigger.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Set a webhook signing secret

> Store the signing secret or public key the provider issued for this endpoint, such as the `whsec_` secret Stripe returns when you create a webhook endpoint. It replaces the existing secret. Pass `previousSecretTtlSeconds` to keep accepting the old secret for a while, for example while the provider rolls its secret.



## OpenAPI

````yaml v3-openapi PUT /api/v1/webhooks/endpoints/{endpointId}/secret
openapi: 3.1.0
info:
  title: Trigger.dev v3 REST API
  description: >-
    The REST API lets you trigger and manage runs on Trigger.dev. You can
    trigger a run, get the status of a run, and get the results of a run. 
  version: 2024-04
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
servers:
  - url: https://api.trigger.dev
    description: Trigger.dev API
security: []
paths:
  /api/v1/webhooks/endpoints/{endpointId}/secret:
    parameters:
      - $ref: '#/components/parameters/webhookEndpointId'
    put:
      tags:
        - webhooks
      summary: Set a webhook signing secret
      description: >-
        Store the signing secret or public key the provider issued for this
        endpoint, such as the `whsec_` secret Stripe returns when you create a
        webhook endpoint. It replaces the existing secret. Pass
        `previousSecretTtlSeconds` to keep accepting the old secret for a while,
        for example while the provider rolls its secret.
      operationId: set_webhook_endpoint_secret_v1
      requestBody:
        required: true
        content:
          application/json:
            schema:
              type: object
              required:
                - secret
              properties:
                secret:
                  type: string
                  minLength: 1
                  maxLength: 4096
                  description: >-
                    The signing secret or public key. Leading and trailing
                    whitespace is trimmed.
                  example: whsec_5f2b...
                previousSecretTtlSeconds:
                  $ref: '#/components/schemas/WebhookPreviousSecretTtlSeconds'
      responses:
        '200':
          description: Successful request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SetWebhookEndpointSecretResponse'
        '400':
          description: Invalid request body
        '401':
          description: Unauthorized request
        '404':
          description: Endpoint not found
      security:
        - secretKey: []
      x-codeSamples:
        - lang: curl
          label: Set a signing secret
          source: >-
            curl -X PUT
            "https://api.trigger.dev/api/v1/webhooks/endpoints/stripe/secret" \
              -H "Authorization: Bearer $TRIGGER_SECRET_KEY" \
              -H "Content-Type: application/json" \
              -d '{"secret": "whsec_..."}'
components:
  parameters:
    webhookEndpointId:
      in: path
      name: endpointId
      required: true
      schema:
        type: string
      description: >-
        The endpoint's declared id (the `id` passed to
        `webhooks.endpoint.define`) or its `wh_` id. A value starting with `wh_`
        is always a generated id, since declared ids can't start with `wh_`. A
        declared id names the endpoint's declared instance in the key's
        environment.
      example: stripe
  schemas:
    WebhookPreviousSecretTtlSeconds:
      type: integer
      minimum: 0
      maximum: 604800
      description: >-
        How long, in seconds, the secret being replaced keeps verifying
        deliveries (at most 7 days). Omit it or pass 0 to replace the secret
        immediately, for example when it leaked.
      example: 3600
    SetWebhookEndpointSecretResponse:
      type: object
      required:
        - id
        - secretSet
      properties:
        id:
          type: string
          description: The endpoint's `wh_` id.
          example: wh_cm1a2b3c4d5e6f
        secretSet:
          type: boolean
          const: true
        previousSecretExpiresAt:
          type: string
          format: date-time
          description: >-
            When the replaced secret stops verifying deliveries. Absent when it
            was replaced immediately.
          example: '2026-10-21T12:00:00.000Z'
  securitySchemes:
    secretKey:
      type: http
      scheme: bearer
      description: >
        Use a named environment API key. It starts with `tr_dev_sk_`,
        `tr_prod_sk_`, `tr_stg_sk_`, etc.


        Create a named API key in the API Keys section of your Trigger.dev
        project dashboard. Choose the narrowest access preset that supports your
        integration.


        Our TypeScript SDK will default to using the value of the
        `TRIGGER_SECRET_KEY` environment variable if it is set. If you are using
        the SDK in a different environment, you can set the key using the
        `configure` function.


        ```typescript

        import { configure } from "@trigger.dev/sdk";


        configure({ accessToken: "tr_dev_sk_1234" });

        ```

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.