{"slug":"rotate-a-webhook-secret","title":"Rotate a webhook secret","tags":["tailscale"],"agent_summary":"Last validated: Jan 20, 2026","trigger_phrases":[],"runnable":false,"markdown":"\r\n# Rotate a webhook secret\r\n\r\nLast validated: Jan 20, 2026\r\n\r\n[Webhook](https://tailscale.com/docs/features/webhooks) secrets authenticate incoming webhook events from Tailscale to your endpoint. You rotate a webhook secret when you need to replace the existing secret with a new one, either as part of regular security maintenance or after a potential compromise. This process generates a new secret while maintaining your webhook endpoint configuration.\r\n\r\n## [Prerequisites](https://tailscale.com/docs/features/webhooks/how-to/rotate-webhook-secret\\#prerequisites)\r\n\r\nTo rotate a webhook secret, ensure you meet the following prerequisites:\r\n\r\n- [Be an Owner, Admin, Network admin, or IT admin](https://tailscale.com/docs/reference/user-roles).\r\n- Have an existing webhook endpoint configured in the admin console.\r\n\r\n## [Instructions](https://tailscale.com/docs/features/webhooks/how-to/rotate-webhook-secret\\#instructions)\r\n\r\nThe following instructions guide you through the process of rotating a webhook secret in the Tailscale admin console.\r\n\r\nRotating a webhook secret replaces the existing secret with a new one. The old secret stops working immediately after rotation, so you need to update your verification routine with the new secret to continue receiving events.\r\n\r\n1. Open the [Webhooks](https://login.tailscale.com/admin/settings/webhooks) page of the admin console.\r\n\r\n2. Find the endpoint for which to rotate the secret, then select the ![ellipsis icon](https://tailscale.com/files/images/icons/fa-ellipsis-h.svg) menu > **Rotate webhook secret**. This opens the **Rotate webhook secret** modal.\r\n\r\n3. Select **Rotate** to confirm you want a new secret.\r\n\r\n4. In the **Rotate webhook secret** modal, select **Copy** to copy the new secret.\r\n\r\n5. Save the secret in a secure location. You won't be able to access it again after closing the modal.\r\n\r\n\r\n\r\nTreat the webhook secret like a password. Make sure to store it in a secure location.\r\n\r\n6. Select **Done**.\r\n\r\n\r\nThe new secret takes effect immediately for all new events. Update your [signature verification](https://tailscale.com/docs/features/webhooks#verifying-an-event-signature) routine with the new secret to continue processing webhook events.\r\n\r\n## [Next steps](https://tailscale.com/docs/features/webhooks/how-to/rotate-webhook-secret\\#next-steps)\r\n\r\nAfter rotating your webhook secret, consider the following next steps:\r\n\r\n- [Verify webhook signatures](https://tailscale.com/docs/features/webhooks#verifying-an-event-signature): Update your verification code with the new secret.\r\n- [Test webhook endpoints](https://tailscale.com/docs/features/webhooks#testing-webhooks): Send test events to confirm your endpoint works with the new secret.\r\n- [Configure webhook events](https://tailscale.com/docs/features/webhooks#setting-up-a-webhook-endpoint): Manage which events trigger notifications to your endpoint.\r\n","html":"

Rotate a webhook secret

\n

Last validated: Jan 20, 2026

\n

Webhook secrets authenticate incoming webhook events from Tailscale to your endpoint. You rotate a webhook secret when you need to replace the existing secret with a new one, either as part of regular security maintenance or after a potential compromise. This process generates a new secret while maintaining your webhook endpoint configuration.

\n

Prerequisites

\n

To rotate a webhook secret, ensure you meet the following prerequisites:

\n\n

Instructions

\n

The following instructions guide you through the process of rotating a webhook secret in the Tailscale admin console.

\n

Rotating a webhook secret replaces the existing secret with a new one. The old secret stops working immediately after rotation, so you need to update your verification routine with the new secret to continue receiving events.

\n
    \n
  1. \n

    Open the Webhooks page of the admin console.

    \n
    2. \n
  2. \n

    Find the endpoint for which to rotate the secret, then select the \"ellipsis menu > Rotate webhook secret. This opens the Rotate webhook secret modal.

    \n
    3. \n
  3. \n

    Select Rotate to confirm you want a new secret.

    \n
    4. \n
  4. \n

    In the Rotate webhook secret modal, select Copy to copy the new secret.

    \n
    5. \n
  5. \n

    Save the secret in a secure location. You won't be able to access it again after closing the modal.

    \n
    6. \n
\n

Treat the webhook secret like a password. Make sure to store it in a secure location.

\n
    \n
  1. Select Done.
    2. \n
\n

The new secret takes effect immediately for all new events. Update your signature verification routine with the new secret to continue processing webhook events.

\n

Next steps

\n

After rotating your webhook secret, consider the following next steps:

\n\n"}