--- title: Zero Downtime Secret Rotation for Webhooks | daily.dev description: Explains why webhook secrets need periodic rotation for security and how rotating a signing key naively breaks signature verification, causing downtime. The... canonical: https://daily.dev/posts/zero-downtime-secret-rotation-for-webhooks-bxz21xbkk twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Zero Downtime Secret Rotation for Webhooks | daily.dev og:description: Explains why webhook secrets need periodic rotation for security and how rotating a signing key naively breaks signature verification, causing downtime. The... og:url: https://daily.dev/posts/zero-downtime-secret-rotation-for-webhooks-bxz21xbkk og:image: https://api.daily.dev/og/posts/bXz21XbkK.png og:image:alt: Zero Downtime Secret Rotation for Webhooks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Zero Downtime Secret Rotation for Webhooks **[Svix Blog](https://daily.dev/sources/svix)** · 4 min read · 0 upvotes · 0 comments ## Summary Explains why webhook secrets need periodic rotation for security and how rotating a signing key naively breaks signature verification, causing downtime. The fix is to sign payloads with both the old and new secret during a transition window, letting consumers verify against multiple space-delimited signatures until they update. Includes a JavaScript snippet showing how to check multiple signatures and notes Svix implements this pattern via its webhook-signature header. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I rotate a webhook signing secret without causing verification failures? Sign each webhook payload with both the old and new secret for a transition period, sending multiple space-delimited signatures in the webhook-signature header, such as 'v1,sig1 v1,sig2'. Consumers verify by checking each signature against the payload and accepting if any one matches, giving them time to update to the new key before dropping the old one. _daily.dev surfaces practical webhook security patterns like this for teams hardening their integrations._ ### Is it a security risk to sign a webhook payload with a compromised secret during key rotation? No, signing a legitimate payload with a compromised secret during rotation does not create a security issue, because it gives an attacker no additional advantage. A compromised key lets an attacker forge fake payloads and sign them, but having a real payload signed with the old key alongside the new one doesn't enable new attacks. _developers weighing webhook security tradeoffs can find this kind of analysis on daily.dev._ ## Similar posts on daily.dev - [Introducing ESC Secret Rotation Webhooks](https://daily.dev/posts/introducing-esc-secret-rotation-webhooks-jio5xdc0r) · Pulumi · 0 upvotes · 0 comments - [The valley of webhooks](https://daily.dev/posts/the-valley-of-webhooks-6ekxclvor) · Hacker News · 0 upvotes · 0 comments - [Your Webhook Endpoint Is a Tiny Distributed System](https://daily.dev/posts/your-webhook-endpoint-is-a-tiny-distributed-system-izgpxyxum) · Ruby Flow · 0 upvotes · 0 comments - [Stripe Webhooks in Production: A 2026 Developer Guide](https://daily.dev/posts/stripe-webhooks-in-production-a-2026-developer-guide-k2uxwifgt) · Alex CloudStar · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#javascript](https://daily.dev/tags/javascript), [#authentication](https://daily.dev/tags/authentication) [View this post on daily.dev](https://daily.dev/posts/zero-downtime-secret-rotation-for-webhooks-bxz21xbkk) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Zero Downtime Secret Rotation for Webhooks","url":"https://daily.dev/posts/zero-downtime-secret-rotation-for-webhooks-bxz21xbkk","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/zero-downtime-secret-rotation-for-webhooks-bxz21xbkk"},"datePublished":"2026-08-23T07:21:37.696Z","dateModified":"2026-08-23T07:28:13.524Z","description":"Explains why webhook secrets need periodic rotation for security and how rotating a signing key naively breaks signature verification, causing downtime. The...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/25fe85c87f4ef140a8e9c273c86fa72a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/25fe85c87f4ef140a8e9c273c86fa72a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Svix Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Svix Blog","logo":"https://media.daily.dev/image/upload/s--Shf9MlOr--/f_auto,q_auto/v1787469609/logos/svix?_a=BAMAMicg0","url":"https://daily.dev/sources/svix"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/zero-downtime-secret-rotation-for-webhooks-bxz21xbkk","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,javascript,authentication","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Svix Blog","item":"https://daily.dev/sources/svix"},{"@type":"ListItem","position":3,"name":"Zero Downtime Secret Rotation for Webhooks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/zero-downtime-secret-rotation-for-webhooks-bxz21xbkk#faq","mainEntity":[{"@type":"Question","name":"How do I rotate a webhook signing secret without causing verification failures?","acceptedAnswer":{"@type":"Answer","text":"Sign each webhook payload with both the old and new secret for a transition period, sending multiple space-delimited signatures in the webhook-signature header, such as 'v1,sig1 v1,sig2'. Consumers verify by checking each signature against the payload and accepting if any one matches, giving them time to update to the new key before dropping the old one. daily.dev surfaces practical webhook security patterns like this for teams hardening their integrations."}},{"@type":"Question","name":"Is it a security risk to sign a webhook payload with a compromised secret during key rotation?","acceptedAnswer":{"@type":"Answer","text":"No, signing a legitimate payload with a compromised secret during rotation does not create a security issue, because it gives an attacker no additional advantage. A compromised key lets an attacker forge fake payloads and sign them, but having a real payload signed with the old key alongside the new one doesn't enable new attacks. developers weighing webhook security tradeoffs can find this kind of analysis on daily.dev."}}]} ```