curl --request POST \
--url https://partner-api.ochy-prod.com/webhook/signature/rotate \
--header 'Authorization: Bearer <token>'import requests
url = "https://partner-api.ochy-prod.com/webhook/signature/rotate"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://partner-api.ochy-prod.com/webhook/signature/rotate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"enabled": true,
"algorithm": "HMAC-SHA256",
"last4": "7Tq2",
"created_at": "2026-03-23T10:45:00Z",
"updated_at": "2026-03-23T11:15:00Z",
"secret": "YOUR_NEW_SIGNING_SECRET"
}{
"detail": "Signature has not been configured yet.",
"code": "signature_not_configured"
}{
"detail": "API Key is missing"
}{
"detail": "API Key is missing"
}{
"detail": "Internal server error",
"code": "insufficient_api_credits"
}Rotate webhook signing secret
Generate a new HMAC-SHA256 signing secret for webhook delivery.
The new secret is returned once in this response. Store it securely and update your
webhook receiver to verify future requests with this value.
curl --request POST \
--url https://partner-api.ochy-prod.com/webhook/signature/rotate \
--header 'Authorization: Bearer <token>'import requests
url = "https://partner-api.ochy-prod.com/webhook/signature/rotate"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://partner-api.ochy-prod.com/webhook/signature/rotate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));{
"enabled": true,
"algorithm": "HMAC-SHA256",
"last4": "7Tq2",
"created_at": "2026-03-23T10:45:00Z",
"updated_at": "2026-03-23T11:15:00Z",
"secret": "YOUR_NEW_SIGNING_SECRET"
}{
"detail": "Signature has not been configured yet.",
"code": "signature_not_configured"
}{
"detail": "API Key is missing"
}{
"detail": "API Key is missing"
}{
"detail": "Internal server error",
"code": "insufficient_api_credits"
}Authorizations
Recommended. Pass your API key as a Bearer token in the Authorization header: Authorization: Bearer YOUR_API_KEY.
Response
New webhook signing secret generated.
Webhook signing configuration. The secret field is returned only when generated or rotated.
Whether Ochy signs webhook requests.
true
Signature algorithm used for webhook requests.
HMAC-SHA256 "HMAC-SHA256"
Last four characters of the current signing secret, for identification.
"n6p8"
When the current signing secret was created (ISO 8601 UTC).
"2026-03-23T10:45:00Z"
When the signature configuration was last updated (ISO 8601 UTC).
"2026-03-23T10:45:00Z"
Full signing secret. Returned only when generated or rotated; store it securely.
"YOUR_GENERATED_SIGNING_SECRET"