# Stage signing key

> Create a secondary key and return its secret once.

Source: https://sndr.sh/docs/api/webhooks/stage-signing-key

`POST https://api.sndr.sh/v1/webhooks/{id}/signing-keys/stage`

Create a secondary key and return its secret once. Events are signed with both keys (v1 and v1s) until you promote or retire it. The body is optional.

Scope: `send`

**Path parameters**

- `id` (string, required): Webhook ID (wh_...).

**Body** (JSON)

- `reason` (string): Short label stored with the key. Defaults to customer.
- `notes` (string): Optional free-form note.

**Request**

```bash
curl -X POST 'https://api.sndr.sh/v1/webhooks/wh_2a7d4e9c-6b1/signing-keys/stage' \
  -H "Authorization: Bearer $SNDR_API_KEY" \
  -H 'Content-Type: application/json' \
  -d '{"reason": "scheduled rotation"}'
```

**Response** (201)

```json
{
  "id":              "whk_61d0a9c7-5e4",
  "webhook_id":      "wh_2a7d4e9c-6b1",
  "status":          "secondary",
  "created_at":      "2026-06-01T13:00:00Z",
  "created_by":      "usr_5b2f8c1e-9a3",
  "rotation_reason": "scheduled rotation",
  "secret":          "Qm3vT8xZ1cR6yH0nB5wL9kD2fJ7sA4gP"
}
```

**Errors**

- `unauthenticated` (401): Missing or invalid API key.
- `invalid_request` (400): Body is missing or not valid JSON (send {} for the defaults).
- `insufficient_scope` (403): The API key is missing the send scope.
- `not_found` (404): Resource does not exist or belongs to a different account.