Skip to main content

Set or rotate the secret your webhooks are signed with

PUT 
/api/partner/webhooks/secret

Sets the secret your webhooks are bound to. Our signature on every webhook covers a SHA-256 hash of this secret, so you can verify the webhook is ours and was made for your secret.

  • Send { "secretKey": "..." } (8-200 characters) to use your own value.
  • Send no secretKey and we generate a strong random secret and return it once in this response.
  • secretKey is the only accepted request property; unknown fields are rejected so a misspelled secret cannot be mistaken for success.

A validation failure returns 400 with the offending field and the reason in details.

The secret is stored encrypted and is write-only: no endpoint ever returns it again, so store it when you set it. Rotation takes effect immediately for webhooks sent after this call; there is no grace period for the old secret.

Request​

Responses​

Secret stored. secretKey is present only when we generated it.