API reference
Rotate the webhook signing secret
Issues a new signing secret and returns it once. Every delivery from now on, including retries, is signed with it. Accept both secrets for a few minutes while you deploy.
View as MarkdownUpdated Oct 17, 2026
POST
/api/external/webhooks/rotate-secretNewIssues a new signing secret and returns it once. Every delivery from now on, including retries, is signed with it. Accept both secrets for a few minutes while you deploy.
Authentication
Send the creator's API key as a bearer token: Authorization: Bearer dpfn_…. See Authentication & API keys.
Responses
200The new secret.
| Name | Type | Description |
|---|---|---|
secret | string | The new whsec_… secret. |
Example response
{
"secret": "whsec_51aa…"
}Errors
| Status | Body | When |
|---|---|---|
| 401 | {"error":"Unauthorized","code":"unauthorized"} | Missing or invalid API key. |
| 403 | {"error":"This endpoint needs a key bound to an approved app.","code":"app_key_required"} | A Personal key was used. |
| 403 | {"error":"Use the app owner's key for this endpoint.","code":"owner_key_required"} | The key was minted by a creator for themselves. App-level calls need a key held by your app owner: their own, or one their agency minted for its personas or managed creators. |
Rate limiting
Every response carries the X-RateLimit-Tier header and, on limited tiers, the per-minute and per-day trios — read X-RateLimit-Remaining and X-RateLimit-Reset instead of hardcoding limits. Details in Rate limits.
Code samples
curl -X POST "https://www.dropfans.io/api/external/webhooks/rotate-secret" \
-H "Authorization: Bearer $DROPFANS_API_KEY"const res = await fetch(`https://www.dropfans.io/api/external/webhooks/rotate-secret`, {
method: 'POST',
headers: {
Authorization: `Bearer ${process.env.DROPFANS_API_KEY}`,
},
});
console.log(await res.json());import os
import requests
res = requests.post(
"https://www.dropfans.io/api/external/webhooks/rotate-secret",
headers={"Authorization": f"Bearer {os.environ['DROPFANS_API_KEY']}"},
)
print(res.json())Questions? [email protected]