Set a signing secret Beta

PUT/api/v1/connections/{connection_id}/trigger-ingress/signing-secret

This endpoint is in beta. Its request and response may change.

Saves the secret the app signs its webhook events with, copied from your app's settings at the provider, so Scalekit can verify each event. Until a secret is set, the webhook URL doesn't accept events. If a secret is already set, a new one starts a rotation: both are accepted until you confirm the rotation, or for at most 24 hours. Read the secret from your server's secrets, never from code. For an app that sends no signature of its own, generate a secret instead.

This page as markdown Triggers overview

REST
Python

Authorization

Authorization: Bearer $TOKEN, an access token from the client credentials grant. See Authentication.

Path parameters

connection_idstringrequired

ID of the connection, in this environment. Up to 64 characters.

Body

signing_secretstringrequired

The secret the provider signs its events with, copied from the provider's app configuration. For Slack this is the Signing Secret under Basic Information, not an API token. Between 8 and 4096 characters. For Gong, the RSA public key shown by 'Show public key'. Never returned by any endpoint and never written to a log.

scalekit_client.actions.triggers.set_signing_secret

Store the signing secret the provider signs its events with. The first call stores it. A call with a different secret starts a rotation: both secrets are accepted until confirm_signing_secret_rotation or for 24 hours. Not retried on UNAVAILABLE, because a retry could advance the rotation.

scalekit_client.actions.triggers.set_signing_secret(
    connection_id: str,
    signing_secret: str,
) -> TriggerIngressEndpoint

Parameters

connection_idstrrequired

The connection (conn_...).

signing_secretstrrequired

The secret from the provider's app configuration (8-4096 characters; surrounding whitespace is trimmed by the server).

Returns TriggerIngressEndpoint: The endpoint, with masked_signing_secret and rotation state.

From scalekit-sdk-python 2.23.0.

Response 200

connection_idstring

ID of the connection this webhook URL belongs to.

idstring

Unique identifier of the connection's webhook endpoint.

masked_signing_secretstring

The stored secret with all but its last four characters replaced, or every character replaced for a secret of 8 characters or fewer. Empty when none is configured. Enough to compare against the secret the provider's app configuration shows, and never enough to sign with.

previous_signing_secret_expires_atstring

When the previous secret stops being accepted even if the rotation is never confirmed: 24 hours after the rotation started. Absent when no rotation is in progress.

rotation_in_progressboolean

Whether the previous signing secret is still accepted alongside the current one. True from the moment a different secret replaces a stored one until the rotation is confirmed, or until previous_signing_secret_expires_at passes.

signing_secret_configuredboolean

Whether a signing secret is stored. While false, every event sent to the URL is answered with 503 so the provider retries it, and the provider's own URL verification fails.

signing_secret_rotation_idstring

Identifies the latest signing-secret rotation; it increases by one each time a rotation starts. Zero when none has ever started. Pass this value to Confirm a signing secret rotation to confirm this specific rotation. A value naming a rotation that a newer one has since replaced is refused rather than confirming the wrong rotation.

urlstring

The URL to paste into the provider's app configuration as the event destination. It is built on your environment's domain, using its custom domain when one is set, and ends in a random token unique to this connection, so treat it as confidential. Returned whether or not a signing secret has been set. The URL accepts request bodies up to 1 MB and answers a larger one with 413. Until a signing secret is set it answers events with 503, so the provider retries them; an event that fails signature verification is answered with 400.

Errors

Every error has the same body: code, message and details. See Errors and rate limits.

400Invalid request, nothing written - connection_id is not a valid connection ID; signing_secret is shorter than 8 characters once leading and trailing whitespace is removed, or longer than 4096 characters; the connection's provider sends no signature of its own, so its secret is generated by Scalekit rather than set (error_code TRIGGER_SIGNING_SECRET_GENERATED_ONLY; call Generate a signing secret instead); or the provider's webhook trigger definitions are temporarily unavailable (error_code TRIGGER_INGRESS_DEFINITIONS_UNAVAILABLE)

404Not found - no webhook URL has been created for this connection yet (error_code TRIGGER_INGRESS_ENDPOINT_NOT_CREATED; call Create a webhook URL first), the connection does not exist in this environment (error_code RESOURCE_NOT_FOUND), or Triggers isn't turned on for your environment (error_code RESOURCE_NOT_FOUND)

409Conflict - a rotation is already in progress. Confirm it with Confirm a signing secret rotation, or wait for the previous secret's expiry, before setting another secret

500Internal error - the signing secret could not be stored; retry the request

Request

REST
Python

curl -sS -X PUT \
  "$SCALEKIT_ENVIRONMENT_URL/api/v1/connections/conn_133400101014997214/trigger-ingress/signing-secret" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "signing_secret": "<Signing Secret from Basic Information in your Slack app>"
  }'

import os

result = scalekit_client.actions.triggers.set_signing_secret(
    connection_id="conn_133400101014997214",
    signing_secret=os.environ["SLACK_SIGNING_SECRET"],
)

Response 200

{
  "id": "tie_149528599802678310",
  "connection_id": "conn_133400101014997214",
  "url": "https://your-env.scalekit.dev/triggers/v1/q7Rk2mVx9TbL4nWc8YpZ3s",
  "signing_secret_configured": true,
  "masked_signing_secret": "****************************a4f9",
  "rotation_in_progress": true,
  "signing_secret_rotation_id": "1",
  "previous_signing_secret_expires_at": "2026-10-29T09:30:00Z"
}