---
title: "Rotate the calling application's webhook signing secret"
method: POST
path: "/v1/applications/webhook-secret/rotate"
tags: ["Authentication", "Encryption"]
---

# Rotate the calling application's webhook signing secret

`POST /v1/applications/webhook-secret/rotate`

Generates a new webhook signing secret for the authenticated application,
stores only its hash, and returns the raw secret once.

Use the returned `webhookSecret` to verify `X-IDaaS-Signature` on inbound webhooks.
The previous webhook secret becomes invalid immediately.

## Response `200`

Webhook secret rotated - new secret returned once

## Other responses

- `401` — Missing or invalid bearer token
- `404` — Application not found

---

[API](https://skmtc.net/reflexpay/apis/idaas-identity-as-a-service-api.md) · [All operations](https://skmtc.net/reflexpay/apis/idaas-identity-as-a-service-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/reflexpay/idaas-identity-as-a-service-api/revisions/db1f954badfb/schema)