Rotating a webhook secret shouldn't mean dropping mail.
In Open Agent Email (open source, self-hosted), POST /v1/webhooks/:id/rotate opens a 24h overlap window. During it, every delivery carries two v1= signatures, one from the old key and one from the new. Your receiver switches keys whenever it's ready, and nothing gets rejected in between. The root secret can be rotated the same way.
Also built in:
- signs timestamp + raw body, and rejects anything outside ±300s, so old requests can't be replayed
- constant-time comparison
- Stripe-style t=…,v1=… header
- public test vectors, checked by a standalone Python verifier, so a port in another language has something to test against
Show more
