Objects

WebhookSecret

Fields

• secretstringrequired

  whsec_ followed by 32 bytes in base64 (new secrets use the standard alphabet with padding, older ones use base64url). Store it on the receiver side; it never appears in API responses again. The Standard Webhooks signing key is the base64 decoding of the part after whsec_.

• previous_valid_untilstring (date-time) | null

  Until when the previous secret is still accepted (after a rotation). null on creation.

Used by

• POST/v1/webhooks/{webhook_id}/rotate-secretRotate the signing secret

Part of

WebhookCreated