Skip to main content
Rotate a destination’s signing secret without a window where your receiver rejects good traffic. Rotation mints a new secret while the previous one keeps verifying during a bounded overlap — you cut the receiver over inside that window.
1

Rotate — the new secret is shown once

2

Add the new secret to your receiver, alongside the old

During the overlap, both secrets validate — the delivery carries both signatures, space-delimited. Configure your Standard Webhooks verifier to accept either so in-flight deliveries signed with the old key still pass while you deploy.
3

Cut over, then drop the old secret

Once the receiver is deployed and verifying the new secret, remove the old one from your verifier. Confirm nothing is failing verification before you do.
The overlap is bounded — treat it as your deploy window, not an indefinite dual-key mode. Rotate again if you miss it; the old secret simply stops verifying when the window closes.