Rotating the secret

Rotating mints a new signing secret and keeps the previous one valid for 24 hours. Both secrets sign every delivery during that window. This is why your handler must accept any matching v1= value.

How to roll a secret

1. Rotate in the portal. The new secret is shown immediately, alongside the previous one and its expiry.
2. Deploy the new secret to your endpoint any time inside the window. Deliveries keep verifying either way, so there is no coordinated cutover.
3. Let the window close. The previous secret stops signing automatically once it expires.

If the old secret leaked

Use Revoke now in the portal. This ends the window immediately instead of waiting out the 24 hours. Any endpoint still holding the old secret fails verification from that point, which is the correct trade-off when the secret is known to be exposed.

Note

Only one previous secret is ever live. Rotating twice inside a window retires the secret before last immediately, so you cannot stack three valid secrets.