Webhooks

Rotate a signing secret

Issues a new secret.

POST/v1/webhook-endpoints/{id}/rotate-secret

TL;DR

Question	Answer
What does it do?	Rotate a signing secret.
What does it need?	An API key or an OAuth access token.
What does it take?	`id` in the path.
What does it return?	Status 200 with a body of type `RotatedSecret`.
In the SDK?	`flung.webhookEndpoints.rotateSecret()`
What can go wrong?	`401` Missing, unknown, revoked or expired API key; `404` No such endpoint in this workspace; `422` The request failed validation; `429` Too many requests for this credential; wait for `retry-after` seconds. Every failure has the same error shape.

What it does

Issues a new secret. For 24 hours every delivery is signed with both the new and the old secret, so you can deploy the new one without missing events; after that only the new one signs.

Example

1curl -X POST 'https://api.flung.dev/v1/webhook-endpoints/whe_aaaaaaaaaaaaaaaaaaaaaaaa/rotate-secret' \2  --header "Authorization: Bearer $FLUNG_API_KEY"

1import { Flung } from '@flung.dev/sdk'2
3const flung = new Flung({ apiKey: process.env.FLUNG_API_KEY! })4const result = await flung.webhookEndpoints.rotateSecret({5  id: 'whe_aaaaaaaaaaaaaaaaaaaaaaaa',6})

1const response = await fetch('https://api.flung.dev/v1/webhook-endpoints/whe_aaaaaaaaaaaaaaaaaaaaaaaa/rotate-secret', {2  method: 'POST',3  headers: {4    'Authorization': `Bearer ${process.env.FLUNG_API_KEY}`,5  },6})7if (!response.ok) throw new Error((await response.json()).error.message)8const result = await response.json()

A successful answer looks like this:

1{2  "secret": "string",3  "previousSecretExpiresAt": "2026-11-01T09:00:00.000Z"4}

Path parameters

Field	Type	Required	Description
`id`	`string`	yes

Responses

Status	Meaning	Body
200	The new secret.	`RotatedSecret`
401	Missing, unknown, revoked or expired API key.	`Error`
404	No such endpoint in this workspace.	`Error`
422	The request failed validation.	`Error`
429	Too many requests for this credential; wait for `retry-after` seconds.	`Error`

Response body

A 200 answer has the type RotatedSecret.

Field	Type	Required	Description
`secret`	`string`	yes	The new signing secret. Shown only in this response.
`previousSecretExpiresAt`	`string`	yes	Until then, deliveries carry signatures from both secrets.

Doc	Why
API reference	Every endpoint
Schemas	Every request and response type
Errors	Every error code and what to do about it