GeezerVison

"@trigger.dev/core": patch

"trigger.dev": patch

The `generate_webhook_secret` and `set_webhook_secret` MCP tools take an optional `previousSecretTtlSeconds` to keep accepting a webhook endpoint's old signing secret while the provider switches to the new one (up to 7 days), and report when the old secret stops working.

} from "@remix-run/react";

import { type ActionFunctionArgs, type LoaderFunctionArgs } from "@remix-run/server-runtime";

import { randomBytes } from "node:crypto";

import { WebhookRoutingTarget, WebhookVerifierArtifact } from "@trigger.dev/core/v3";

import {

WebhookPreviousSecretTtlSeconds,

WebhookRoutingTarget,

WebhookVerifierArtifact,

} from "@trigger.dev/core/v3";

import type { WebhookValueSource } from "@trigger.dev/core/v3";

import { type MutableRefObject, Suspense, useEffect, useRef, useState } from "react";

import { TypedAwait, typeddefer, useTypedLoaderData } from "remix-typedjson";

import { throwPermissionDenied } from "~/utils/permissionDenied";

import { parseFiniteInt } from "~/utils/searchParams";

import { webhookEngine, webhookVerifyTokenKey } from "~/v3/webhookEngine.server";

import { PreviousSecretTtlSeconds } from "~/v3/webhookSigningSecret";

import {

generateWebhookSigningSecret,

storeWebhookSigningSecret,

const PreviousSecretTtlFormField = z.object({

previousSecretTtlSeconds: z.coerce.number().pipe(PreviousSecretTtlSeconds).optional(),

previousSecretTtlSeconds: z.coerce.number().pipe(WebhookPreviousSecretTtlSeconds).optional(),

const SetSecretSchema = PreviousSecretTtlFormField.extend({

import { json } from "@remix-run/server-runtime";

import { RotateWebhookEndpointSecretRequestBody } from "@trigger.dev/core/v3";

import { z } from "zod";

import { webhookPrisma } from "~/db.server";

import { webhookEndpointLookup } from "~/v3/webhookEndpointLookup";

import { createActionApiRoute } from "~/services/routeBuilders/apiBuilder.server";

import { safeJsonParse } from "~/utils/json";

import { PreviousSecretTtlSeconds } from "~/v3/webhookSigningSecret";

import { generateWebhookSigningSecret } from "~/v3/webhookSigningSecret.server";

const ParamsSchema = z.object({ endpointId: z.string() });

const RotateSecretRequestBody = z.object({

previousSecretTtlSeconds: PreviousSecretTtlSeconds.optional(),

const { action, loader } = createActionApiRoute(

},

async ({ params, authentication, request }) => {

const rawBody = await request.text();

const body = RotateSecretRequestBody.safeParse(rawBody ? safeJsonParse(rawBody) : {});

const body = RotateWebhookEndpointSecretRequestBody.safeParse(

rawBody ? safeJsonParse(rawBody) : {}

);

if (!body.success) {

return json({ error: "Invalid request body", issues: body.error.issues }, { status: 400 });

}

import { webhookPrisma } from "~/db.server";

import { webhookEndpointLookup } from "~/v3/webhookEndpointLookup";

import { createActionApiRoute } from "~/services/routeBuilders/apiBuilder.server";

import { PreviousSecretTtlSeconds } from "~/v3/webhookSigningSecret";

import { storeWebhookSigningSecret } from "~/v3/webhookSigningSecret.server";

const ParamsSchema = z.object({ endpointId: z.string() });

const SetSecretRequestBody = SetWebhookEndpointSecretRequestBody.extend({

previousSecretTtlSeconds: PreviousSecretTtlSeconds.optional(),

const { action, loader } = createActionApiRoute(

{

params: ParamsSchema,

body: SetSecretRequestBody,

body: SetWebhookEndpointSecretRequestBody,

method: "PUT",

allowJWT: true,

corsStrategy: "all",

function secretStep(endpoint: WebhookSetupPromptEndpoint, asymmetric: boolean): string {

const source = endpoint.source;

const replacing = endpoint.hasSigningSecret

? ` ${asymmetric ? "A public key" : "A secret"} is already set; replacing it breaks deliveries until ${source} uses the new one, so only replace it when you're creating or updating the webhook in ${source}.`

? ` ${asymmetric ? "A public key" : "A secret"} is already set; only replace it when you're creating or updating the webhook in ${source}, and pass \`previousSecretTtlSeconds\` (for example 3600) so deliveries signed with the old one keep verifying until ${source} uses the new one.`

: "";

if (asymmetric) {

import { z } from "zod";

export const MAX_PREVIOUS_SECRET_TTL_SECONDS = 7 * 24 * 60 * 60;

export const PreviousSecretTtlSeconds = z

.number()

.int()

.min(0)

.max(MAX_PREVIOUS_SECRET_TTL_SECONDS);

expect(prompt).toContain("Public key: set");

expect(prompt).toContain("Copy its public key and store it with `set_webhook_secret`.");

expect(prompt).toContain("A public key is already set; replacing it breaks deliveries");

expect(prompt).toContain("A public key is already set; only replace it when");

expect(prompt).toContain("pass `previousSecretTtlSeconds`");

});

it("asks which events to send when nothing subscribes yet", () => {

import { describe, expect, it } from "vitest";

import {

activeSigningSecrets,

MAX_PREVIOUS_SECRET_TTL_SECONDS,

PreviousSecretTtlSeconds,

replaceStoredSigningSecret,

} from "~/v3/webhookSigningSecret";

MAX_WEBHOOK_PREVIOUS_SECRET_TTL_SECONDS as MAX_PREVIOUS_SECRET_TTL_SECONDS,

WebhookPreviousSecretTtlSeconds as PreviousSecretTtlSeconds,

} from "@trigger.dev/core/v3";

import { activeSigningSecrets, replaceStoredSigningSecret } from "~/v3/webhookSigningSecret";

const now = new Date("2026-10-20T12:00:00.000Z");

const later = (seconds: number) => new Date(now.getTime() + seconds * 1000);

summary: Generate a webhook signing secret

description: >-

requestBody:

required: false

content:

application/json:

schema:

type: object

properties:

previousSecretTtlSeconds:

$ref: "#/components/schemas/WebhookPreviousSecretTtlSeconds"

responses:

"200":

description: Successful request

schema:

$ref: "#/components/schemas/RotateWebhookEndpointSecretResponse"

"400":

description: The endpoint's source verifies with a public key, so a secret can't be generated

description: The endpoint's source verifies with a public key, so a secret can't be generated, or the body is invalid

content:

application/json:

schema:

label: Generate a signing secret

source: |-

"/api/v1/webhooks/endpoints/{endpointId}/secret":

parameters:

- $ref: "#/components/parameters/webhookEndpointId"

summary: Set a webhook signing secret

description: >-

requestBody:

required: true

content:

maxLength: 4096

description: The signing secret or public key. Leading and trailing whitespace is trimmed.

example: whsec_5f2b...

previousSecretTtlSeconds:

$ref: "#/components/schemas/WebhookPreviousSecretTtlSeconds"

responses:

"200":

description: Successful request

type: string

description: The new signing secret. It is returned only in this response and can't be read again.

example: whsec_5f2b...

previousSecretExpiresAt:

type: string

format: date-time

description: When the replaced secret stops verifying deliveries. Absent when it was replaced immediately.

example: "2026-10-21T12:00:00.000Z"

SetWebhookEndpointSecretResponse:

type: object

required: [id, secretSet]

secretSet:

type: boolean

const: true

previousSecretExpiresAt:

type: string

format: date-time

description: When the replaced secret stops verifying deliveries. Absent when it was replaced immediately.

example: "2026-10-21T12:00:00.000Z"

WebhookPreviousSecretTtlSeconds:

type: integer

minimum: 0

maximum: 604800

description: >-

example: 3600

WebhookDeliveryStatus:

type: string

enum: [pending, processing, succeeded, failed, filtered, unmatched]

| --- | --- |

| `list_webhook_endpoints` | Lists the environment's endpoints, with their URL and whether a secret is set. |

| `get_webhook_endpoint_details` | Reads one endpoint: URL, subscribers and their filters, secret state, and the setup prompt. |

| `generate_webhook_secret` | Generates a signing secret and returns it once, for providers where you choose the secret. |

| `set_webhook_secret` | Stores a secret the provider issued. |

| `generate_webhook_secret` | Generates a signing secret and returns it once, for providers where you choose the secret. Optionally keeps accepting the old secret (`previousSecretTtlSeconds`). |

| `set_webhook_secret` | Stores a secret the provider issued. Optionally keeps accepting the old secret (`previousSecretTtlSeconds`). |

Without the MCP server, the same operations are available on the REST API with the environment's secret key:

Choose **Rotate signing secret** to replace a provider-supplied secret. For a secret you generate, choose **Regenerate secret**, copy the new value, and update the provider's configuration. Use **Rotate public key** when replacing an asymmetric provider's key.

Both dialogs ask how long to keep accepting the old secret: **Stop immediately**, 1 hour, 24 hours (the default) or 7 days. Until then, deliveries signed with either secret verify, so you can update the provider without failing any. Choose **Stop immediately** if the old secret leaked.

Through the MCP tools or the REST API, pass `previousSecretTtlSeconds` (at most 604800, 7 days). The response's `previousSecretExpiresAt` says when the old secret stops working. Without it, the old secret stops working straight away:

curl -X POST "https://api.trigger.dev/api/v1/webhooks/endpoints/github/rotate-secret" \

-H "Authorization: Bearer $TRIGGER_SECRET_KEY" \

-H "Content-Type: application/json" \

-d '{"previousSecretTtlSeconds": 3600}'

<Warning>

Trigger.dev stores credentials encrypted and doesn't display saved values. Copy a generated secret

before closing the dialog. Deliveries signed with the old secret fail verification after rotation.

before closing the dialog.

</Warning>