Skip to main content
A signing secret should be rotated when it may have leaked, or on a regular schedule. For 24 hours after a rotation, Usertick signs every delivery with both the new and the previous secret, so the endpoint can switch without missing a delivery.

​
Rotate a secret in the dashboard

1

Open the endpoint

Under Settings → Developers → Webhooks, select the endpoint’s row.
2

Rotate the secret

In the actions under the row, select Rotate secret and then Rotate now.
3

Copy the new secret

Before you select I saved it, copy the new secret that starts with whsec_, because it is shown only once.
4

Update your endpoint within 24 hours

Within 24 hours, put the new secret into your endpoint’s configuration and deploy it.
Until the 24 hours are over, the previous secret still verifies too.

​
Signatures during the rotation window

During the window, webhook-signature carries two signatures separated by a space, with the new secret’s signature first:
The verification code accepts a delivery when any signature matches, so it works with either secret during the window. After 24 hours, only the new secret signs. A second rotation inside the window keeps only the secret it replaces, so the oldest secret stops signing at once.

​
Subscriptions made by the API or an app

A subscription keeps the secret it received when it subscribed, and the dashboard can’t rotate it. Subscribing the same URL again with the same credential returns the same secret. To get a new secret, delete the subscription and subscribe again.