# Rotate the signing secret

Source: https://checkslip.com/en/docs/rotate-endpoint-secret

POST `https://api.checkslip.com/api/webhooks/endpoints/{endpoint_id}/secret/rotate`

API key

Issues a new secret, shown only in this response. The old secret keeps working for 24 hours (see previous_secret_expires_at); meanwhile every message carries both signatures in the webhook-signature header, separated by a space, so you can switch your system to the new secret without missing a message. You cannot rotate again within those 24 hours (ROTATION_IN_PROGRESS). An Idempotency-Key is required. The account owner gets an email, which never contains the secret. Needs an API key with webhook:manage.

## Parameters

| Field | In | Type | Required |
| --- | --- | --- | --- |
| `endpoint_id` | path | `string` | yes |
| `traceparent` | header | `string` | no |
| `Idempotency-Key` | header | `string` | yes |

## Responses

### 200 `application/json`

| Field | Type | Required |
| --- | --- | --- |
| `secret` | `string` | yes |
| `previous_secret_expires_at` | `string (date-time)` | yes |

### Possible errors

400 401 403 404 409 422

An error as Problem Details. All codes are listed at [Error codes](https://checkslip.com/en/docs/errors)

**cURL**

```bash
curl -X POST https://api.checkslip.com/api/webhooks/endpoints/string/secret/rotate \
  -H "Authorization: Bearer $CHECKSLIP_API_KEY" \
  -H "Idempotency-Key: order-1042-slip-1"
```

**Node.js**

```javascript
const res = await fetch("https://api.checkslip.com/api/webhooks/endpoints/string/secret/rotate", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CHECKSLIP_API_KEY}`,
    "Idempotency-Key": "order-1042-slip-1",
  },
});
const data = await res.json();
```

**Python**

```python
import os

import requests

res = requests.post(
    "https://api.checkslip.com/api/webhooks/endpoints/string/secret/rotate",
    headers={
        "Authorization": f"Bearer {os.environ['CHECKSLIP_API_KEY']}",
        "Idempotency-Key": "order-1042-slip-1",
    },
)
data = res.json()
```

```json
{
  "secret": "string",
  "previous_secret_expires_at": "2026-11-05T09:30:00+07:00"
}
```