Skip to main content
POST
Rotate webhook signing secret

Authorizations

Authorization
string
header
required

Recommended. Pass your API key as a Bearer token in the Authorization header: Authorization: Bearer YOUR_API_KEY.

Response

New webhook signing secret generated.

Webhook signing configuration. The secret field is returned only when generated or rotated.

enabled
boolean

Whether Ochy signs webhook requests.

Example:

true

algorithm
enum<string>

Signature algorithm used for webhook requests.

Available options:
HMAC-SHA256
Example:

"HMAC-SHA256"

last4
string

Last four characters of the current signing secret, for identification.

Example:

"n6p8"

created_at
string<date-time>

When the current signing secret was created (ISO 8601 UTC).

Example:

"2026-03-23T10:45:00Z"

updated_at
string<date-time>

When the signature configuration was last updated (ISO 8601 UTC).

Example:

"2026-03-23T10:45:00Z"

secret
string

Full signing secret. Returned only when generated or rotated; store it securely.

Example:

"YOUR_GENERATED_SIGNING_SECRET"