Rotate your organization’s webhook signing secret from the Webhooks
page. The new secret is shown exactly once when you rotate — Tumban
never displays it again, so copy it immediately. Use the secret to
verify the signature on incoming webhooks; see
Signature verification.
Rotate the secret
Open Webhooks
From the sidebar, click Webhooks.
Rotate the secret
In the Webhook Secret tile, click Rotate Secret. The
description on the tile explains: “Used to verify incoming
webhook payloads. Rotating immediately invalidates the old secret
— update your server before rotating.”
Copy the new secret
The new secret appears once with the prompt “New secret — copy
it now. It won’t be shown again.” Click Copy and store it in
your secret manager.
Update your verification code before rotating, or accept a brief
window where signatures will not verify. Tumban signs every new
webhook with the current secret only — old secrets become inactive
immediately.
Storage model
Unlike API keys (which Tumban stores only as a SHA-256 hash), the
webhook secret is retained in plaintext on the server. Tumban needs
the raw value on every webhook delivery to compute the HMAC signature.
Because the secret is shown to you exactly once at rotation time and
never reappears anywhere in the dashboard, there is no recovery
path — store the value immediately when it is displayed. If you lose
it, rotate again and update every verifier in lockstep.
Permissions
Rotating the webhook secret requires an admin role. Non-admins do
not see the Rotate Secret control.
