Skip to main content
HTTP status: 429 · Title: “Rotation cooldown active” · Retry-After: seconds remaining in the 60-second cooldown

​
When it fires

POST /v1/auth/api-keys/me/webhook-secret/rotate was called within 60 seconds of a previous successful rotation for the same key.

​
Why the cooldown exists

Read this one carefully: the cooldown is not a rate limit, it is a rollback-safety guard. Each rotation keeps your previous secret so a rotation that breaks your signature verifier can be rolled back. If you rotate twice in quick succession, the second rotation replaces that saved secret with the first rotation’s new secret, which you may never have received (for example, the first request timed out, your client retried, and the first response was lost). A later rollback would then restore a secret no verifier was ever configured with. The cooldown turns that dangerous case into a visible 429 instead of silently breaking the rollback path.

​
How to fix

  • If you captured the new secret from the previous rotation: wait for Retry-After to elapse and call again. The cooldown is per key; other keys are unaffected.
  • If you did not capture it (timeout, lost response, dropped connection): don’t retry. Contact ZeroID support, who can rotate the secret in a way that preserves rollback. Rotating again yourself would replace the saved secret with one you never received.

​
Response headers

  • Retry-After: <seconds>, the time left in the cooldown, computed from the previous rotation.
See Webhooks.