How to rotate your Stripe webhook signing secret

Updated October 2026

Stripe will not roll a webhook signing secret for you with overlap, by API. The Dashboard has a "Roll secret" button that does it with up to 24 hours of grace. By API, the move is different: create a second endpoint, run both for a while, then delete the first one.

Here's the exact process, from Stripe's own docs, and how we tested it ourselves.

The manual steps

1. Create a new endpoint with the same events as the old one: POST /v1/webhook_endpoints, body url, enabled_events[] copied from the old endpoint's list. Stripe's own docs, checked December 18, 2026, confirm the response includes secret, "Only returned at creation."
2. Give the new endpoint a URL that differs slightly from the old one, even just a query string like ?v=2. Whether Stripe allows two endpoints with the exact same URL isn't documented either way, so don't rely on it.
3. Update your app to accept both secrets while the swap is in flight: try constructEvent with the new secret, then the old one, since a Stripe library checks one secret per call.
4. Dedupe on event.id. Stripe's own webhooks guide explains why duplicates happen on purpose here: "Stripe generates a unique secret key for each endpoint... if you use multiple endpoints, you must obtain a secret for each one," so the same event arrives once per endpoint, each signed differently.
5. Once the app has handled events on the new secret with no errors, delete the old endpoint: DELETE /v1/webhook_endpoints/{id}.

What breaks if you miss a place

Stripe's own docs say a failed delivery, one your app rejects with a bad signature, is retried for up to three days in live mode, and retries stop once the endpoint is deleted. So deleting the old endpoint too early doesn't just lose future events, it cancels the retry queue for anything that endpoint already tried and failed to deliver.

How to check the old secret is actually dead

After you delete the old endpoint, Stripe stops sending it anything, there's no separate "secret is dead" check beyond the endpoint itself being gone. Watch your app's logs for a day to confirm nothing is still arriving signed with the old secret, which would mean the delete didn't take.

We tested this ourselves

On October 24, 2026, we rotated a Stripe webhook signing secret in Stripe test mode: created a new endpoint and secret, kept both working during the switch, then deleted the old endpoint once the new one was confirmed live. The create-swap-delete pattern above is what we actually ran, not a guess from the docs alone.

The account-wide limit to watch

Stripe caps an account at 16 event destinations. Stripe's own docs state this plainly. The swap above needs one free slot the whole time both endpoints exist, so check your current count before starting a rotation on an account that's already near the limit.

Or let Key Robot do it

Key Robot does this for you today, with a restricted key that can only write webhook endpoints. It makes a new endpoint with the same address and events, puts the new secret in your app and the old one in STRIPE_WEBHOOK_SECRET_PREVIOUS, checks your app, and then deletes the old endpoint. Your app must accept both secrets for those few minutes, and skip an event id it has already handled.

In our live test on October 26, 2026, in Stripe test mode, one change took 13 seconds on a Cloudflare Workers app. When the app refused the next secret, the robot put the old one back.

See how to rotate your Stripe API key for the secret key itself, a Dashboard-only step with no API around it, or the rotate hub for every service.