Browse documentation
Security
Secrets & rotation
Each endpoint has its own signing secret. Treat it like a password: store it in a secret manager, scope it to one environment, and rotate it on a schedule.
- Add the new secret to your verifier and accept both old and new signatures.
- Rotate in Hooks from the endpoint’s security settings.
- Wait for in-flight retries to finish, then remove the old secret from your verifier.
A workspace-level secret can sign every endpoint unless overridden. Secrets are encrypted at rest and never displayed in full after creation.
If a secret leaks, rotate immediately and review delivery logs for unexpected destinations or replay attempts.
Was this page helpful?
Tell us if something was missing or unclear.
Ready to try it?Create a free workspace and send your first event.