Rotate the webhook secret
curl --request POST \
--url https://api.usecobalt.com/v1/webhook/rotate-secret \
--header 'access_token: <api-key>' \
--header 'client_id: <api-key>' \
--header 'client_secret: <api-key>'import requests
url = "https://api.usecobalt.com/v1/webhook/rotate-secret"
headers = {
"client_id": "<api-key>",
"client_secret": "<api-key>",
"access_token": "<api-key>"
}
response = requests.post(url, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {client_id: '<api-key>', client_secret: '<api-key>', access_token: '<api-key>'}
};
fetch('https://api.usecobalt.com/v1/webhook/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.usecobalt.com/v1/webhook/rotate-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"access_token: <api-key>",
"client_id: <api-key>",
"client_secret: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.usecobalt.com/v1/webhook/rotate-secret"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("client_id", "<api-key>")
req.Header.Add("client_secret", "<api-key>")
req.Header.Add("access_token", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.usecobalt.com/v1/webhook/rotate-secret")
.header("client_id", "<api-key>")
.header("client_secret", "<api-key>")
.header("access_token", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.usecobalt.com/v1/webhook/rotate-secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["client_id"] = '<api-key>'
request["client_secret"] = '<api-key>'
request["access_token"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"success": true,
"message": "<string>",
"webhook_secret_key": "<string>"
}{
"success": false,
"message": "<string>"
}{
"success": false,
"message": "<string>"
}{
"success": false,
"message": "<string>"
}Webhooks
Rotate Webhook Secret
Generates a new signing secret for your account. This rotates the single account-wide webhook signing key, so every webhook delivery under this account is signed with the new key going forward.
POST
/
webhook
/
rotate-secret
Rotate the webhook secret
curl --request POST \
--url https://api.usecobalt.com/v1/webhook/rotate-secret \
--header 'access_token: <api-key>' \
--header 'client_id: <api-key>' \
--header 'client_secret: <api-key>'import requests
url = "https://api.usecobalt.com/v1/webhook/rotate-secret"
headers = {
"client_id": "<api-key>",
"client_secret": "<api-key>",
"access_token": "<api-key>"
}
response = requests.post(url, headers=headers)
print(response.text)const options = {
method: 'POST',
headers: {client_id: '<api-key>', client_secret: '<api-key>', access_token: '<api-key>'}
};
fetch('https://api.usecobalt.com/v1/webhook/rotate-secret', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.usecobalt.com/v1/webhook/rotate-secret",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"access_token: <api-key>",
"client_id: <api-key>",
"client_secret: <api-key>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.usecobalt.com/v1/webhook/rotate-secret"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("client_id", "<api-key>")
req.Header.Add("client_secret", "<api-key>")
req.Header.Add("access_token", "<api-key>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.usecobalt.com/v1/webhook/rotate-secret")
.header("client_id", "<api-key>")
.header("client_secret", "<api-key>")
.header("access_token", "<api-key>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.usecobalt.com/v1/webhook/rotate-secret")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["client_id"] = '<api-key>'
request["client_secret"] = '<api-key>'
request["access_token"] = '<api-key>'
response = http.request(request)
puts response.read_body{
"success": true,
"message": "<string>",
"webhook_secret_key": "<string>"
}{
"success": false,
"message": "<string>"
}{
"success": false,
"message": "<string>"
}{
"success": false,
"message": "<string>"
}Rotating the secret replaces the account-wide webhook signing key. Because the key is shared across every connection and webhook URL registered under your account, all future deliveries are signed with the new key. Update your verification logic before rotating, or immediately after, to avoid rejecting valid webhooks.
Example Request
curl -X POST https://api.usecobalt.com/v1/webhook/rotate-secret \
-H 'Content-Type: application/json' \
-H 'client_id: ci_live_198908HJDKJSH98789OHKJL' \
-H 'client_secret: cs_live_9827hofdsklOYYHJLJh'
Example Response
{
"success": true,
"message": "Webhook secret rotated successfully",
"webhook_secret_key": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2"
}
Only
client_id and client_secret headers are required. Store the returned webhook_secret_key securely and use it to verify webhook signatures.