> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fyatu.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Regenerate Webhook Secret
> Generate a new HMAC-SHA256 webhook signing secret. Previous secret is immediately invalidated. POST /webhooks/regenerate-secret.
# Regenerate Webhook Secret
Generate a new webhook secret for signing webhook payloads. This immediately invalidates your previous secret.
After regenerating your secret, you must update your webhook handler with the new secret. Any webhooks sent after regeneration will be signed with the new secret, and verification using the old secret will fail.
## Request
```bash theme={null}
curl -X POST https://api.fyatu.com/api/v3/webhooks/secret/regenerate \
-H "Authorization: Bearer YOUR_ACCESS_TOKEN"
```
No request body is required.
## Response
Whether the request was successful
Your new webhook secret. **Store this securely!**
ISO 8601 timestamp of when the secret was regenerated
A reminder about updating your webhook handler
```json 200 theme={null}
{
"success": true,
"status": 200,
"message": "Webhook secret regenerated successfully",
"data": {
"webhookSecret": "whsec_x1y2z3a4b5c6d7e8f9g0h1i2j3k4l5m6",
"regeneratedAt": "2026-01-15T10:30:00+00:00",
"note": "Store this secret securely. It will not be shown again. Update your webhook handler with this new secret."
},
"meta": {
"requestId": "req_abc123xyz789",
"timestamp": "2026-01-15T10:30:00+00:00"
}
}
```
## When to Regenerate
You should regenerate your webhook secret if:
* Your secret was accidentally exposed
* An employee with access to the secret has left your organization
* You want to rotate secrets as a security best practice
* You suspect unauthorized access to your webhooks
## After Regenerating
1. **Copy the new secret** from the response immediately
2. **Update your webhook handler** with the new secret
3. **Test webhook delivery** using the [Test Webhook](/v3/api-reference/webhooks/test) endpoint
4. **Monitor your logs** to ensure webhooks are being verified correctly
The old secret is invalidated immediately. There is no grace period. Make sure you're ready to update your handler before regenerating.
## OpenAPI
````yaml v3/openapi.json POST /webhooks/secret/regenerate
openapi: 3.1.0
info:
title: FYATU API v3
description: >-
FYATU API v3 with JWT authentication for Collections, Payouts, and Card
Issuing.
version: 3.0.0
contact:
name: FYATU Support
url: https://fyatu.com
email: support@fyatu.com
servers:
- url: https://api.fyatu.com/api/v3
description: Production
security: []
tags:
- name: Authentication
description: JWT token management endpoints
- name: Account
description: Business account, wallet, and address management
- name: Collections
description: Accept payments from customers via checkout sessions
- name: Refunds
description: Issue refunds for completed collections
- name: Payouts
description: Send money to Fyatu account holders
- name: Cardholders
description: Cardholder management for card issuing programs
- name: Cards
description: Issue, fund, freeze, and manage virtual cards
- name: Webhooks
description: Webhook configuration and management
paths:
/webhooks/secret/regenerate:
post:
tags:
- Webhooks
summary: Regenerate Webhook Secret
description: >-
Generate a new webhook secret for signing webhook payloads. This
immediately invalidates your previous secret.
operationId: regenerateWebhookSecret
responses:
'200':
description: Webhook secret regenerated successfully
content:
application/json:
schema:
$ref: '#/components/schemas/WebhookSecretResponse'
example:
success: true
status: 200
message: Webhook secret regenerated successfully
data:
webhookSecret: whsec_x1y2z3a4b5c6d7e8f9g0h1i2j3k4l5m6
regeneratedAt: '2026-01-15T10:30:00+00:00'
note: >-
Store this secret securely. It will not be shown again.
Update your webhook handler with this new secret.
meta:
requestId: req_abc123xyz789
timestamp: '2026-01-15T10:30:00+00:00'
'401':
$ref: '#/components/responses/Unauthorized'
security:
- BearerAuth: []
components:
schemas:
WebhookSecretResponse:
type: object
properties:
success:
type: boolean
example: true
status:
type: integer
example: 200
message:
type: string
data:
type: object
properties:
webhookSecret:
type: string
description: Your new webhook secret. Store this securely!
regeneratedAt:
type: string
format: date-time
note:
type: string
description: Reminder to update your webhook handler
meta:
$ref: '#/components/schemas/Meta'
Meta:
type: object
properties:
requestId:
type: string
description: Unique request ID for tracking
example: req_abc123def456
timestamp:
type: string
format: date-time
description: ISO 8601 timestamp of the response
ErrorResponse:
type: object
properties:
success:
type: boolean
example: false
status:
type: integer
example: 401
message:
type: string
example: Invalid credentials
error:
$ref: '#/components/schemas/Error'
meta:
$ref: '#/components/schemas/Meta'
Error:
type: object
properties:
code:
type: string
description: Error code for programmatic handling
example: AUTH_INVALID_CREDENTIALS
details:
type: array
items:
$ref: '#/components/schemas/ValidationError'
description: Validation error details (for VALIDATION_ERROR)
ValidationError:
type: object
properties:
field:
type: string
description: Field that failed validation
example: appId
message:
type: string
description: Validation error message
example: AppId is required
responses:
Unauthorized:
description: Authentication required or token invalid
content:
application/json:
schema:
$ref: '#/components/schemas/ErrorResponse'
example:
success: false
status: 401
message: Unable to identify business
error:
code: AUTH_TOKEN_INVALID
meta:
requestId: req_abc123
timestamp: '2026-01-05T10:30:00+00:00'
securitySchemes:
BearerAuth:
type: http
scheme: bearer
bearerFormat: JWT
description: JWT access token obtained from /auth/token
````