End the rotation overlap early

POST/signing-secret/revoke

Sample request

cURL

curl -X POST -H "x-api-key: $ABYSSALE_API_KEY" \
  https://api.abyssale.com/signing-secret/revoke

Node.js

import abyssale from '@abyssale/sdk';

const { data, error } = await abyssale.revokeSigningSecret();

if (error) console.error(error.id, error.message);
else console.log(data);

Python

from abyssale import Abyssale

with Abyssale() as client:
    result = client.revoke_signing_secret()

print(result)

Example 200 response

{
  "secret": "whsec_2f1a8c4e6b9d0a7c3e5f8b1d4a6c9e2f0b3d5a7c1e4f6b8d0a2c5e7f9b1d3a5c",
  "created_at_ts": 1755561234
}

Example 401 error response

{
  "message": "Unauthorized: missing or invalid API key.",
  "id": "unauthorized"
}

Invalidate the previous secret, ending the 24-hour overlap early. The current secret is untouched. Signing applies the change within 60 seconds — deliveries already in flight may still carry a signature from the revoked secret for up to a minute.

Behaviour, limits and caveats

Use it after a rotation prompted by a leak rather than by routine hygiene. Note what it does and does not achieve for webhooks: you are the verifier, so a forged request stops being accepted the moment you deploy a receiver that no longer trusts the old secret — that does not wait on us. This endpoint closes the window on our side, which matters because we keep signing with the old secret until it lapses.

Deliberately abrupt: within a minute, anything still signed with the old secret stops verifying, so a receiver you have not yet redeployed will start rejecting deliveries.

Takes no request body, and is safe to call when there is no overlap to end. Like rotate, it mints a secret if the workspace has none — so calling it on a workspace that never enabled signing turns signing on.

Response 200

The current secret. Any previous secret is no longer valid.

secret string always

The secret to verify X-Abyssale-Signature with. Prefixed whsec_ so it is recognisable if it turns up somewhere it should not.

created_at_ts integer always

Unix second the secret was first issued.

rotated_at_ts integer | null

Unix second of the most recent rotation, or null if the secret has never been rotated.

previous_secret_expires_at_ts integer | null

When the previous secret stops being honoured — 24 hours after the rotation that demoted it.

More about previous_secret_expires_at_ts

When the previous secret stops being honoured — 24 hours after the rotation that demoted it. null when there is no overlap in progress, either because nothing was rotated, because the window has lapsed, or because it was ended with POST /signing-secret/revoke.

While this is set, deliveries carry two v1 hashes and a receiver holding either secret verifies. The previous secret's value is never returned — only its expiry.

Errors

Every failure uses the shared error envelope — {id, message, errors?}. Branch on id, never on message. See Errors.

Status	When
401	Unauthorized — missing or invalid API key.
429	Too Many Requests.
500	Internal Server Error — an unexpected error occurred on our side.