> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usertick.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate a secret

> Switch a webhook to a new signing secret without missing a delivery.

A signing secret should be rotated when it may have leaked, or on a regular schedule. For 24 hours after a rotation, Usertick signs every delivery with both the new and the previous secret, so the endpoint can switch without missing a delivery.

## Rotate a secret in the dashboard

**1. Open the endpoint**

Under **Settings → Developers → Webhooks**, select the endpoint's row.

**2. Rotate the secret**

In the actions under the row, select **Rotate secret** and then **Rotate now**.

**3. Copy the new secret**

Before you select **I saved it**, copy the new secret that starts with `whsec_`, because it is shown only once.

**4. Update your endpoint within 24 hours**

Within 24 hours, put the new secret into your endpoint's configuration and deploy it.

Until the 24 hours are over, the previous secret still verifies too.

## Signatures during the rotation window

During the window, `webhook-signature` carries two signatures separated by a space, with the new secret's signature first:

```http theme={null}
webhook-signature: v1,K5oZfzN95Z9UVu1EsfQmfVNQhnkZ2pj9o9NDN/H/pI4= v1,3sPc3Q0vEy2lO2D4tOV5Y0+QhZ8LhH1fJ3ZbTzGm1kE=
```

The [verification code](https://docs.usertick.com/developers/webhooks/verify.md) accepts a delivery when any signature matches, so it works with either secret during the window.

After 24 hours, only the new secret signs. A second rotation inside the window keeps only the secret it replaces, so the oldest secret stops signing at once.

## Subscriptions made by the API or an app

A subscription keeps the secret it received when it subscribed, and the dashboard can't rotate it. Subscribing the same URL again with the same credential returns the same secret. To get a new secret, [delete the subscription](https://docs.usertick.com/developers/api/reference/unsubscribe-webhook.md) and [subscribe](https://docs.usertick.com/developers/api/reference/subscribe-webhook.md) again.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.