Regenerate Webhook Secret
curl --request POST \
--url https://api.fyatu.com/api/v3/webhooks/secret/regenerate \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.fyatu.com/api/v3/webhooks/secret/regenerate"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.fyatu.com/api/v3/webhooks/secret/regenerate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.fyatu.com/api/v3/webhooks/secret/regenerate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.fyatu.com/api/v3/webhooks/secret/regenerate"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.fyatu.com/api/v3/webhooks/secret/regenerate")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.fyatu.com/api/v3/webhooks/secret/regenerate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"success": true,
"status": 200,
"message": "Webhook secret regenerated successfully",
"data": {
"webhookSecret": "whsec_x1y2z3a4b5c6d7e8f9g0h1i2j3k4l5m6",
"regeneratedAt": "2026-01-15T10:30:00+00:00",
"note": "Store this secret securely. It will not be shown again. Update your webhook handler with this new secret."
},
"meta": {
"requestId": "req_abc123xyz789",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}{
"success": false,
"status": 401,
"message": "Unable to identify business",
"error": {
"code": "AUTH_TOKEN_INVALID"
},
"meta": {
"requestId": "req_abc123",
"timestamp": "2026-01-05T10:30:00+00:00"
}
}Regenerate Webhook Secret
Generate a new webhook signing secret, immediately invalidating the previous one. POST /webhooks/secret/regenerate. Requires webhooks:write scope.
POST
/
webhooks
/
secret
/
regenerate
Regenerate Webhook Secret
curl --request POST \
--url https://api.fyatu.com/api/v3/webhooks/secret/regenerate \
--header 'Authorization: Bearer <token>'import requests
url = "https://api.fyatu.com/api/v3/webhooks/secret/regenerate"
headers = {"Authorization": "Bearer <token>"}
response = requests.post(url, headers=headers)
print(response.text)const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};
fetch('https://api.fyatu.com/api/v3/webhooks/secret/regenerate', options)
.then(res => res.json())
.then(res => console.log(res))
.catch(err => console.error(err));<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://api.fyatu.com/api/v3/webhooks/secret/regenerate",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_HTTPHEADER => [
"Authorization: Bearer <token>"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"net/http"
"io"
)
func main() {
url := "https://api.fyatu.com/api/v3/webhooks/secret/regenerate"
req, _ := http.NewRequest("POST", url, nil)
req.Header.Add("Authorization", "Bearer <token>")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://api.fyatu.com/api/v3/webhooks/secret/regenerate")
.header("Authorization", "Bearer <token>")
.asString();require 'uri'
require 'net/http'
url = URI("https://api.fyatu.com/api/v3/webhooks/secret/regenerate")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
response = http.request(request)
puts response.read_body{
"success": true,
"status": 200,
"message": "Webhook secret regenerated successfully",
"data": {
"webhookSecret": "whsec_x1y2z3a4b5c6d7e8f9g0h1i2j3k4l5m6",
"regeneratedAt": "2026-01-15T10:30:00+00:00",
"note": "Store this secret securely. It will not be shown again. Update your webhook handler with this new secret."
},
"meta": {
"requestId": "req_abc123xyz789",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}{
"success": false,
"status": 401,
"message": "Unable to identify business",
"error": {
"code": "AUTH_TOKEN_INVALID"
},
"meta": {
"requestId": "req_abc123",
"timestamp": "2026-01-05T10:30:00+00:00"
}
}Overview
Generate a new webhook signing secret. The previous secret is immediately invalidated — webhooks will be signed with the new secret from this point forward.When to Use
- Your current
webhookSecrethas been compromised or exposed - Rotating secrets as part of your security policy
- You’ve lost the secret and need a new one
Response Fields
| Field | Type | Description |
|---|---|---|
webhookSecret | string | New signing secret — store immediately, shown only once |
secretNote | string | Reminder that the secret is shown only once |
Migration Strategy
To avoid dropping webhooks during rotation:1
Regenerate Secret
Call this endpoint to get a new secret
2
Update Your Server
Deploy the new secret to your webhook handler
3
Verify
Send a test webhook with
POST /webhooks/test to confirm the new secret validates correctlyThe new
webhookSecret is shown only once in the response. Store it immediately. The old secret stops working as soon as this endpoint is called.
