Use this endpoint to replace an endpoint's signing key, for example if the key may have leaked or you lost it. The response shows the new key in full, once, and previousSigningKeyExpiresAt says until when the old key still works.

For the next 24 hours, Everee signs each delivery with both keys. The x-everee-webhook-signature header then carries two signatures, v1=<new>,v1=<old>, and a handler that verifies as described accepts either. That lets you switch without missing an event:

1. Rotate the key and store the new one.
2. Deploy your handler with the new key. Until then it keeps verifying with the old key.
3. After 24 hours the old key stops signing.

If you rotate again before the 24 hours are up, the oldest key stops signing at once: only the newest key and the one it just replaced still sign. Rotating twice that quickly is a way to cut a key off immediately, so do it only when you mean to.

Errors