Skip to content
Pidgely Docs

API reference · Webhooks

Rotate a signing secret

POSThttps://api.pidgely.com/webhooks/{id}/signing-secret/rotate
View as Markdown

Generates a new signing secret and returns it. The old secret stops working immediately, including for retries already queued, so deploy the new secret to your receiver right after rotating.

Authorization: Bearer pdg_…. An API key with full_access. A sending_access key gets 401 restricted_api_key.

Path parameters

Name Type Required Description
id string Yes Resource id UUID.

Request

Node.js
import { Pidgely } from 'pidgely';

const pidgely = new Pidgely(process.env.PIDGELY_API_KEY);

const { data, error } = await pidgely.webhooks.rotateSigningSecret('0199d7f2-8b1d-7c3a-a2e5-4f9c6d0b1e73');
console.log(data ?? error);
Python
import os
import pidgely

pidgely.api_key = os.environ["PIDGELY_API_KEY"]

result = pidgely.Webhooks.rotate_signing_secret("0199d7f2-8b1d-7c3a-a2e5-4f9c6d0b1e73")
print(result)
PHP
<?php

require __DIR__ . '/vendor/autoload.php';

$pidgely = Pidgely::client(getenv('PIDGELY_API_KEY'));

$result = $pidgely->webhooks->rotateSigningSecret('0199d7f2-8b1d-7c3a-a2e5-4f9c6d0b1e73');
var_dump($result);
Go
package main

import (
	"context"
	"fmt"
	"os"

	"github.com/pidgely/pidgely-go"
)

func main() {
	ctx := context.Background()
	client := pidgely.NewClient(os.Getenv("PIDGELY_API_KEY"))

	result, err := client.Webhooks.RotateSigningSecret(ctx, "0199d7f2-8b1d-7c3a-a2e5-4f9c6d0b1e73")
	if err != nil {
		panic(err)
	}
	fmt.Println(result)
}
Ruby
require "pidgely"

Pidgely.api_key = ENV["PIDGELY_API_KEY"]

result = Pidgely::Webhooks.rotate_signing_secret("0199d7f2-8b1d-7c3a-a2e5-4f9c6d0b1e73")
puts result
cURL
curl -X POST 'https://api.pidgely.com/webhooks/0199d7f2-8b1d-7c3a-a2e5-4f9c6d0b1e73/signing-secret/rotate' \
  -H "Authorization: Bearer $PIDGELY_API_KEY"

Response

200 OK

JSON
{
  "object": "webhook",
  "id": "0199d7f2-8b1d-7c3a-a2e5-4f9c6d0b1e73",
  "signing_secret": "whsec_Q2w3E4r5T6y7U8i9O0pAsDfGhJkLzXcV"
}

Response fields

Name Type Required Description
object string No Object type.
id string No Unique id (UUID). UUID.
signing_secret string No Secret (whsec_…) used to verify webhook signatures.

Errors

Errors have the shape {"statusCode", "name", "message"}. See Errors for the full list.

Status Name When
401 missing_api_key, restricted_api_key No Authorization: Bearer header, or a sending_access key called an endpoint that needs full_access.
403 invalid_api_key, validation_error The API key is invalid or revoked, or the request is not allowed for this account (unverified domain, plan limit, paused account).
404 not_found The resource does not exist in this account (or the id is not a valid UUID).
422 validation_error A field is missing or invalid; message names it.
429 rate_limit_exceeded Too many requests per second. Wait for Retry-After seconds.