> ## Documentation Index
> Fetch the complete documentation index at: https://trigger.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Generate a webhook signing secret

> **Private beta:** [request access](https://trigger.dev/webhooks-beta) to use webhooks.
Generate a new signing secret for the endpoint, store it, and return it once. Use this for providers where you choose the secret, such as GitHub. It replaces any existing secret, so deliveries fail verification until the provider uses the new one. Endpoints whose source verifies with a public key refuse this; set the provider's key with the set secret endpoint instead.



## OpenAPI

````yaml v3-openapi POST /api/v1/webhooks/endpoints/{endpointId}/rotate-secret
openapi: 3.1.0
info:
  title: Trigger.dev v3 REST API
  description: >-
    The REST API lets you trigger and manage runs on Trigger.dev. You can
    trigger a run, get the status of a run, and get the results of a run. 
  version: 2024-04
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0.html
servers:
  - url: https://api.trigger.dev
    description: Trigger.dev API
security: []
paths:
  /api/v1/webhooks/endpoints/{endpointId}/rotate-secret:
    parameters:
      - $ref: '#/components/parameters/webhookEndpointId'
    post:
      tags:
        - webhooks
      summary: Generate a webhook signing secret
      description: >-
        **Private beta:** [request access](https://trigger.dev/webhooks-beta) to
        use webhooks.

        Generate a new signing secret for the endpoint, store it, and return it
        once. Use this for providers where you choose the secret, such as
        GitHub. It replaces any existing secret, so deliveries fail verification
        until the provider uses the new one. Endpoints whose source verifies
        with a public key refuse this; set the provider's key with the set
        secret endpoint instead.
      operationId: rotate_webhook_endpoint_secret_v1
      responses:
        '200':
          description: Successful request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RotateWebhookEndpointSecretResponse'
        '400':
          description: >-
            The endpoint's source verifies with a public key, so a secret can't
            be generated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Unauthorized request
        '404':
          description: Endpoint not found
      security:
        - secretKey: []
      x-codeSamples:
        - lang: curl
          label: Generate a signing secret
          source: >-
            curl -X POST
            "https://api.trigger.dev/api/v1/webhooks/endpoints/github/rotate-secret"
            \
              -H "Authorization: Bearer $TRIGGER_SECRET_KEY"
components:
  parameters:
    webhookEndpointId:
      in: path
      name: endpointId
      required: true
      schema:
        type: string
      description: >-
        The endpoint's declared id (the `id` passed to
        `webhooks.endpoint.define`) or its `wh_` id. A value starting with `wh_`
        is always a generated id, since declared ids can't start with `wh_`. A
        declared id names the endpoint's declared instance in the key's
        environment.
      example: stripe
  schemas:
    RotateWebhookEndpointSecretResponse:
      type: object
      required:
        - id
        - secretSet
        - secret
      properties:
        id:
          type: string
          description: The endpoint's `wh_` id.
          example: wh_cm1a2b3c4d5e6f
        secretSet:
          type: boolean
          const: true
        secret:
          type: string
          description: >-
            The new signing secret. It is returned only in this response and
            can't be read again.
          example: whsec_5f2b...
    ErrorResponse:
      type: object
      properties:
        error:
          type: string
          example: Something went wrong
      required:
        - error
  securitySchemes:
    secretKey:
      type: http
      scheme: bearer
      description: >
        Use a named environment API key. It starts with `tr_dev_sk_`,
        `tr_prod_sk_`, `tr_stg_sk_`, etc.


        Create a named API key in the API Keys section of your Trigger.dev
        project dashboard. Choose the narrowest access preset that supports your
        integration.


        Our TypeScript SDK will default to using the value of the
        `TRIGGER_SECRET_KEY` environment variable if it is set. If you are using
        the SDK in a different environment, you can set the key using the
        `configure` function.


        ```typescript

        import { configure } from "@trigger.dev/sdk";


        configure({ accessToken: "tr_dev_sk_1234" });

        ```

````

This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.