> ## Documentation Index
> Fetch the complete documentation index at: https://docs.gamecart.gg/llms.txt
> Use this file to discover all available pages before exploring further.

# Rotate the signing secret

> The previous secret stops signing immediately.



## OpenAPI

````yaml /api-reference/openapi/seller-v1.yaml post /v1/seller/webhooks/{id}/rotate-secret
openapi: 3.1.0
info:
  description: >-
    Read and manage your store's orders, delivery commands, servers and
    webhooks.
  title: Gamecart Seller API
  version: 1.0.0
servers:
  - url: https://api.gamecart.gg
security: []
tags:
  - description: The store behind the API token.
    name: Store
  - description: Orders and the actions on them.
    name: Orders
  - description: Internal notes on orders. Only the seller sees them.
    name: Order notes
  - description: The delivery command queue.
    name: Commands
  - description: >-
      Run the queue from your own executor, with the same protocol as the
      official connectors.
    name: Command execution
  - description: Game servers that receive delivery commands.
    name: Servers
  - description: Webhook endpoints and their deliveries.
    name: Webhooks
paths:
  /v1/seller/webhooks/{id}/rotate-secret:
    post:
      tags:
        - Webhooks
      summary: Rotate the signing secret
      description: The previous secret stops signing immediately.
      parameters:
        - in: path
          name: id
          required: true
          schema:
            $ref: '#/components/schemas/UUID'
      responses:
        '200':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/WebhookEndpoint'
          description: The endpoint with its new secret.
        '401':
          $ref: '#/components/responses/Unauthorized'
        '402':
          $ref: '#/components/responses/PlanRequired'
        '403':
          $ref: '#/components/responses/Forbidden'
        '404':
          $ref: '#/components/responses/NotFound'
        '429':
          $ref: '#/components/responses/RateLimited'
      security:
        - apiToken:
            - webhooks:write
components:
  schemas:
    UUID:
      format: uuid
      pattern: >-
        [a-fA-F0-9]{8}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{4}-[a-fA-F0-9]{12}
      type: string
    WebhookEndpoint:
      description: An HTTPS endpoint that receives signed order events.
      properties:
        createdAt:
          $ref: '#/components/schemas/Instant'
          examples:
            - '2026-09-25T13:05:00.000Z'
          type: string
        enabled:
          description: Disabled endpoints receive nothing, including test deliveries.
          type: boolean
        events:
          description: Subscribed events.
          examples:
            - - order.payment_approved
          items:
            type: string
          type: array
        id:
          $ref: '#/components/schemas/UUID'
          examples:
            - 0f8fad5b-d9cb-469f-a165-70867728950e
          type: string
        name:
          examples:
            - ERP
          type: string
        secret:
          description: >-
            Signing secret. Returned only on create and on secret rotation;
            store it now.
          examples:
            - gcwhsec_7vJt0mX2...
          type: string
        secretFingerprint:
          description: Last characters of the signing secret, to tell secrets apart.
          examples:
            - '******Xy12ab'
          type: string
        updatedAt:
          $ref: '#/components/schemas/Instant'
          examples:
            - '2026-09-25T13:05:00.000Z'
          type: string
        url:
          examples:
            - https://erp.example.com/gamecart
          type: string
      type: object
    Instant:
      examples:
        - '2022-03-10T16:15:50.000Z'
      format: date-time
      type: string
    Problem:
      description: >-
        RFC 9457 problem details. Decide on `status` and `code`; `detail` is
        localized text for people.
      properties:
        code:
          description: Stable machine-readable code.
          examples:
            - ORDER_NOT_FOUND
          type: string
        detail:
          examples:
            - Order not found.
          type: string
        errors:
          description: Field errors of a validation failure.
          items:
            $ref: '#/components/schemas/FieldProblem'
          type: array
        instance:
          examples:
            - /v1/seller/orders/GC-NOPE
          type: string
        requiredScope:
          description: Scopes the operation needs. Present on `INTEGRATION_SCOPE_MISSING`.
          examples:
            - - orders:read
              - orders:buyer:read
          items:
            type: string
          type: array
        retryAfterSeconds:
          description: Seconds to wait. Present on `RATE_LIMIT_ERROR`.
          examples:
            - 17
          type: integer
        status:
          examples:
            - 404
          type: integer
        title:
          examples:
            - Not Found
          type: string
        traceId:
          description: Identifier to quote when contacting support.
          examples:
            - ede70d1d-66d8-4af7-9a4e-a8775b047380
          type: string
        type:
          examples:
            - about:blank
          type: string
      type: object
    FieldProblem:
      properties:
        code:
          description: Message key of the violation.
          examples:
            - validation.required
          type: string
        field:
          examples:
            - content
          type: string
        message:
          examples:
            - This field is required.
          type: string
      type: object
  responses:
    Unauthorized:
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
      description: The token is missing or invalid (`INVALID_INTEGRATION_TOKEN`).
    PlanRequired:
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
      description: The store's plan does not include API access (`PLAN_FEATURE_REQUIRED`).
    Forbidden:
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
      description: >-
        The token lacks a required scope (`INTEGRATION_SCOPE_MISSING`);
        `requiredScope` lists every scope the operation needs.
    NotFound:
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
      description: >-
        The resource does not exist in this store. A resource of another store
        answers the same way.
    RateLimited:
      content:
        application/problem+json:
          schema:
            $ref: '#/components/schemas/Problem'
      description: The rate limit for this route was reached (`RATE_LIMIT_ERROR`).
      headers:
        Retry-After:
          description: Seconds until the next accepted call.
          schema:
            type: integer
  securitySchemes:
    apiToken:
      description: >-
        API token created in the dashboard under Integrations > API. Tokens
        start with `gci_`.
      scheme: bearer
      type: http

````