2 min read
Trigger rotation
Rotate from the partner console or API. You receive the new whsec_ secret; the old one keeps working for 24 hours so in-flight deliveries never fail.
Verify against both
During the overlap, accept a delivery if it verifies under either secret. Requests may also carry multiple v1= values — a match on any is valid (see signature verification).
function verifyAny(raw, header, secrets) {
return secrets.some(s => verify(raw, header, s));
}Retire the old secret
Once the 24 hours pass, remove the old secret from your config. Verification continues smoothly under the new one.
Frequently asked questions
Will I miss events during rotation?
No — that is the point of the overlap. As long as you verify against both secrets for 24 hours, every delivery is accepted.
What if I lost my secret entirely?
Rotate to issue a fresh one. The secret is only shown once at endpoint registration, so rotation is the recovery path.
Funding for UK limited companies
Credicorp lends to your company, not to you personally — short-term working capital with no personal guarantee. See what your business could access.