---
title: "Secrets and rotation — Webhooks for Laravel | Roundly"
description: "Generated and imported secrets, encryption at rest, shown-once DTOs, rotation with a grace period in both directions, and what deleting wipes."
url: https://roundly-consulting.com/open-source/docs/webhooks-for-laravel/secrets
language: en
---

[All packages](https://roundly-consulting.com/open-source.md)

[Webhooks for Laravel](https://roundly-consulting.com/open-source/docs/webhooks-for-laravel.md)

# Secrets and rotation

- Generated — whsec\_ + standard base64 of secrets.bytes (32) random bytes. The HMAC key is the decoded bytes, and the prefix makes them recognisable to secret scanners.
- Imported (inbound, create(secret: '…')) — stored verbatim, 1–1 024 bytes, no control characters. How the string becomes key bytes is the scheme’s choice. On the default scheme a whsec\_… secret must be standard base64 that decodes to at least one byte, else InvalidEndpointException; custom schemes (a Stripe-style whsec\_ used raw) are not held to that.
- At rest — Laravel’s encrypted cast on secret and previous\_secret, both hidden. Never in resources, about, events, logs or exception messages (#\[SensitiveParameter\] everywhere).
- Shown once — in CreatedInboundEndpoint, CreatedOutboundEndpoint and RotatedSecret, each of which redacts itself in print\_r, var\_dump and json\_encode.

## Rotation

```php
$rotated = Webhooks::inbound()->rotateSecret($inboundEndpoint);                          // grace: secrets.grace_seconds (1 day)
$rotated = Webhooks::outbound()->rotateSecret($outboundEndpoint, grace: now()->addHours(6));
$rotated = Webhooks::inbound()->rotateSecret($inboundEndpoint, grace: now());            // no overlap
$rotated = Webhooks::inbound()->rotateSecret($inboundEndpoint, secret: $sendersNewSecret); // import (inbound)

$rotated->secret;       // the new secret, shown once
$rotated->graceEndsAt;  // when the old one stops working
```

- The current secret becomes the previous one, the new one becomes current, and previous\_secret\_expires\_at is the grace end. A grace longer than secrets.max\_grace\_seconds (7 days) or in the past throws SecretRotationException.
- Rotating again during a grace drops the oldest secret at once. The row is locked, so two concurrent rotations keep a consistent pair. EndpointSecretRotated fires, with no secret in it.
- Inbound, both secrets verify during the grace and the delivery records which one matched (signature\_slot current or previous). Outbound, both sign — two v1 entries, the new one first — so the receiver can switch whenever it likes.
- Grace is enforced at use time; webhooks:prune clears expired previous secrets.

```bash
php artisan webhooks:rotate-secret outbound 12 --grace=21600   # prints the new secret once
```

## Deleting an endpoint

delete() wipes the secret and the previous secret at once — outbound, the URL and custom headers too. A deleted endpoint is dead; undeleting it by hand would need a new secret through rotateSecret(). This is deliberate: a deleted endpoint’s secret is not kept around for years. The row stays for the log until webhooks:prune has removed every delivery that points at it.

## Show your open-source love

This package is free and MIT-licensed. If it saves you time, a one-off donation or a Patreon membership keeps it maintained, tested and documented.

[More ways to support, including crypto](https://roundly-consulting.com/support-us.md)

By donating, you agree to our [donation terms](https://roundly-consulting.com/donation-terms.md).

[Support our open source work (opens in a new tab)](https://donate.stripe.com/dRmeVe8FX5PF1Qd9pXcEw00) [Join us on Patreon (opens in a new tab)](https://www.patreon.com/cw/roundly)

## Want this built into your product?

We integrate our packages into custom Laravel and AI builds. Tell us what you're working on and we'll reply within 48 hours.

[Get a quote in 48 hours](https://roundly-consulting.com/contact.md) [Browse all packages](https://roundly-consulting.com/open-source/docs/webhooks-for-laravel.md)