Rotate the webhook signing key

curl --request POST \
  --url https://api.nango.dev/environment/webhook-signing-key/rotate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "webhook_signing_key": "8a27fe09-327c-43ec-8f75-b1f212904f45"
}
'

import requests

url = "https://api.nango.dev/environment/webhook-signing-key/rotate"

payload = { "webhook_signing_key": "8a27fe09-327c-43ec-8f75-b1f212904f45" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({webhook_signing_key: '8a27fe09-327c-43ec-8f75-b1f212904f45'})
};

fetch('https://api.nango.dev/environment/webhook-signing-key/rotate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.nango.dev/environment/webhook-signing-key/rotate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'webhook_signing_key' => '8a27fe09-327c-43ec-8f75-b1f212904f45'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.nango.dev/environment/webhook-signing-key/rotate"

	payload := strings.NewReader("{\n  \"webhook_signing_key\": \"8a27fe09-327c-43ec-8f75-b1f212904f45\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.nango.dev/environment/webhook-signing-key/rotate")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"webhook_signing_key\": \"8a27fe09-327c-43ec-8f75-b1f212904f45\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.nango.dev/environment/webhook-signing-key/rotate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"webhook_signing_key\": \"8a27fe09-327c-43ec-8f75-b1f212904f45\"\n}"

response = http.request(request)
puts response.read_body

{
  "data": {
    "webhook_signing_key": "5f1c0d2e-6a1b-4f3c-9d8e-7b6a5c4d3e2f"
  }
}

POST

environment

webhook-signing-key

rotate

Rotate the webhook signing key

curl --request POST \
  --url https://api.nango.dev/environment/webhook-signing-key/rotate \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "webhook_signing_key": "8a27fe09-327c-43ec-8f75-b1f212904f45"
}
'

import requests

url = "https://api.nango.dev/environment/webhook-signing-key/rotate"

payload = { "webhook_signing_key": "8a27fe09-327c-43ec-8f75-b1f212904f45" }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: JSON.stringify({webhook_signing_key: '8a27fe09-327c-43ec-8f75-b1f212904f45'})
};

fetch('https://api.nango.dev/environment/webhook-signing-key/rotate', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.nango.dev/environment/webhook-signing-key/rotate",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'webhook_signing_key' => '8a27fe09-327c-43ec-8f75-b1f212904f45'
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.nango.dev/environment/webhook-signing-key/rotate"

	payload := strings.NewReader("{\n  \"webhook_signing_key\": \"8a27fe09-327c-43ec-8f75-b1f212904f45\"\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.nango.dev/environment/webhook-signing-key/rotate")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"webhook_signing_key\": \"8a27fe09-327c-43ec-8f75-b1f212904f45\"\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.nango.dev/environment/webhook-signing-key/rotate")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"webhook_signing_key\": \"8a27fe09-327c-43ec-8f75-b1f212904f45\"\n}"

response = http.request(request)
puts response.read_body

{
  "data": {
    "webhook_signing_key": "5f1c0d2e-6a1b-4f3c-9d8e-7b6a5c4d3e2f"
  }
}

Requires an Environment API key with the environment:webhook_signing_key:rotate scope. It rotates the key of the environment the API key belongs to.

Replaces the key Nango uses to sign webhooks. The new key is returned in the response, and stays readable under Environment Settings > Webhooks > Signing key. To import an existing key, pass webhook_signing_key in the body. The value must be a UUID v4; uppercase characters are normalized to lowercase. You should generate it using a cryptographically secure random generator, such as crypto.randomUUID(). The security of a supplied key depends on how you generate and protect it; Nango validates its format but cannot verify its randomness. Omit the request body or send {} to generate a random key.

{
  "webhook_signing_key": "8a27fe09-327c-43ec-8f75-b1f212904f45"
}

For up to 5 minutes after a rotation, webhooks are signed with either the old or the new key. Accept both until then.

{
  "data": {
    "webhook_signing_key": "5f1c0d2e-6a1b-4f3c-9d8e-7b6a5c4d3e2f"
  }
}

Authorizations

Authorization

string

header

required

An Environment API key from your Nango environment, or an Account API key for account-level endpoints.

Body

application/json

webhook_signing_key

string<uuid>

Optional UUID v4 signing key to import. If omitted, Nango generates a random key.

Pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-4[0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$

Example:

"8a27fe09-327c-43ec-8f75-b1f212904f45"

Response

The new webhook signing key

data

object

required

Show child attributes

Getting started

Guides

Reference

Rotate the webhook signing key

Authorizations

Body

Response