Objective

This article shows you how to create, activate, and delete the pre-shared signature keys on a webhook setting, so you can rotate the secret your server uses to verify that requests genuinely came from Twilio.

Product

Twilio Console

Environment

Twilio Console

Procedure

1. In the Twilio Console, open Webhook configuration.
2. Select the Webhook settings list tab, then select the setting's Name to open its details page.
3. Scroll to the Signature keys section. Each row shows the Key SID, Date created, and a Status of Active for the key currently in use.
4. To add a key, select Create new key. A confirmation shows the new key's SID and secret — copy the secret immediately, because it is not shown again.
5. To switch which key Twilio signs with, open the actions menu on the key you want and select Set as active.
6. To remove a key, open its actions menu and select Delete.

Additional Information

• The Signature keys section only appears when the setting's signature validation method is Pre-shared key. If the setting uses your account auth token or no validation at all, change it with Edit > Edit signature first.
• To rotate a key without interruption: create the new key, update your server to accept it, set it as active, then delete the old key.
• If the setting has no keys yet, the section prompts you to create one to enable shared key validation.

This content was generated by AI and reviewed, edited, and verified by a human.