---
title: "Rotate the HMAC secret for webhook signing."
method: POST
path: "/v1/projects/{projectId}/callbackConfig/rotate"
tags: ["brand-callbacks"]
---

# Rotate the HMAC secret for webhook signing.

`POST /v1/projects/{projectId}/callbackConfig/rotate`

Generates a new server-side HMAC secret for the specified project and replaces the
existing one. The full secret is returned once in the response body — this is the only
time it is visible in plain text. Store it securely immediately after this call.

Use this endpoint when you want Sinch to generate a cryptographically random secret
rather than supplying your own.

## Path parameters

- `projectId` string, required

## Response `200`

New secret generated. The full secret is returned once — store it securely.

- CallbackConfigSecretResponse — Response body returned once after setting or rotating the HMAC secret. The full secret is included here and will not be returned again in plain text. Store it securely immediately.
  - `projectId` string — Project ID this callback configuration belongs to.
  - `hmacSecret` string, password — The full HMAC secret for webhook signature verification. Returned only once — on creation or rotation.

## Other responses

- `401` — UNAUTHENTICATED: Missing or invalid authentication credentials.
- `403` — PERMISSION_DENIED: The authenticated user does not have permission to perform this operation.
- `404` — NOT_FOUND: The project id introduced does not exist.
- `429` — RESOURCE_EXHAUSTED: Too many requests. The client has exceeded the rate limit.
- `500` — INTERNAL: Internal server error. Typically, a server bug.

---

[API](https://skmtc.net/sinch/apis/sinch-compliance-api-brands.md) · [All operations](https://skmtc.net/sinch/apis/sinch-compliance-api-brands/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/sinch/sinch-compliance-api-brands/revisions/fcc788f31a0a/schema)