Rotating a Webhook's Signing Secret Without Breaking the Sender

If you've ever suspected a webhook secret leaked — pasted into the wrong chat, logged somewhere it shouldn't have been — Workflows now has a direct way to rotate it.

How inbound webhooks work today

Every inbound webhook trigger in Workflows is verified per-workflow, using a signed, minted token — the platform checks the signature on the way in against a secret tied to that specific webhook, not a shared platform-wide key.

What rotating does

There's now a dedicated rotate-secret action for a given workflow's webhook. Trigger it and the workflow gets a new signing secret, invalidating the old one for verification purposes going forward.

The part to plan for

Rotating a secret is only half the job — the sender on the other end (whatever system is calling your webhook) needs to be updated with the new secret too, or its calls will start failing verification. This is standard practice across any API or webhook provider that supports secret rotation at all, and we followed the same shape: rotate on our side, then update the sender, in that order, so you don't create a gap where the old secret is dead but the new one hasn't propagated yet.

Who this is for

This is aimed squarely at anyone security-conscious enough to treat "this secret might be compromised" as a real possibility worth acting on quickly, rather than something to quietly live with. If that's you, the rotate action is in the workflow's settings — no need to delete and recreate the webhook trigger from scratch.