# Secrets & rotation

Each endpoint has its own signing secret. Treat it like a password: store it in a secret manager, scope it to one environment, and rotate it on a schedule.

## Rotation without downtime

1. **Add the new secret** to your verifier and accept both old and new signatures.
2. **Rotate in Hooks** from the endpoint's security settings, or call `POST /v1/endpoints/{id}/rotate-secret`.
3. **Wait for in-flight retries** to finish, then remove the old secret from your verifier.

A workspace-level secret can sign every endpoint unless overridden. Secrets are encrypted at rest and never displayed in full after creation.

> If a secret leaks, rotate immediately and review delivery logs for unexpected destinations or replay attempts.