> ## Documentation Index
> Fetch the complete documentation index at: https://docs.browserbase.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate a Webhook signing secret

> Issue a new signing secret for a webhook. By default the previous secret keeps verifying for 24 hours so a receiver can be updated without dropping deliveries; pass `revokeImmediately` to end that window at once. The new secret is returned only here.



## OpenAPI

````yaml post /v1/webhooks/{id}/secret
openapi: 3.0.0
info:
  title: Browserbase API
  description: Browserbase API for 3rd party developers
  version: v1
servers:
  - url: https://api.browserbase.com
    description: Public endpoint
    variables: {}
security:
  - BrowserbaseAuth: []
tags: []
paths:
  /v1/webhooks/{id}/secret:
    post:
      summary: Rotate a Webhook signing secret
      description: >-
        Issue a new signing secret for a webhook. By default the previous secret
        keeps verifying for 24 hours so a receiver can be updated without
        dropping deliveries; pass `revokeImmediately` to end that window at
        once. The new secret is returned only here.
      operationId: Webhooks_rotateSecret
      parameters:
        - name: id
          in: path
          description: The webhook ID.
          required: true
          schema:
            type: string
            format: uuid
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                revokeImmediately:
                  description: >-
                    Expire the old secret at once instead of honouring it for 24
                    hours. Use when responding to a leak; deliveries signed with
                    the old secret stop verifying immediately.
                  type: boolean
                  default: false
              additionalProperties: false
      responses:
        '200':
          description: The new signing secret.
          content:
            application/json:
              schema:
                description: The new signing secret. Shown once; store it now.
                type: object
                properties:
                  secret:
                    description: The new signing secret, prefixed `whsec_`.
                    type: string
                required:
                  - secret
        '429':
          description: >-
            Too many previous secrets are still inside their grace window. Wait
            for one to expire, or retry with `revokeImmediately`.
          content:
            application/json:
              schema:
                description: >-
                  Too many previous secrets are still inside their grace window.
                  Wait for one to expire, or retry with `revokeImmediately`.
      x-codeSamples:
        - lang: javascript
          label: Node.js
          source: |-
            import Browserbase from "@browserbasehq/sdk";

            const bb = new Browserbase({
              apiKey: process.env.BROWSERBASE_API_KEY,
            });

            const { secret } = await bb.webhooks.rotateSecret("<webhook-id>");

            console.log(secret);
        - lang: python
          label: Python
          source: |-
            import os

            from browserbase import Browserbase

            bb = Browserbase(api_key=os.environ["BROWSERBASE_API_KEY"])

            rotated = bb.webhooks.rotate_secret("<webhook-id>")

            print(rotated.secret)
        - lang: bash
          label: cURL
          source: >-
            curl --request POST
            https://api.browserbase.com/v1/webhooks/<webhook-id>/secret --header
            "X-BB-API-Key: $BROWSERBASE_API_KEY"
components:
  securitySchemes:
    BrowserbaseAuth:
      type: apiKey
      in: header
      name: X-BB-API-Key
      description: Your [Browserbase API Key](https://www.browserbase.com/settings).

````