Verified BursaPay workflow: Handle webhook endpoint changes without breaking event verification.
1. Overview & Purpose
Webhook secrets are protected credentials, and endpoint configuration can be updated or deactivated through the developer API.
2. Requirements & Setup
Keep a secure record of the active secret and update the receiver before changing production configuration.
3. Step-by-Step Workflow
- Deploy receiver support for the new secret first when a coordinated rotation is required.
- Update the endpoint or secret through the portal/API.
- Send a test delivery.
- Retire the previous secret only after successful verification of the new path.
4. Rules & Troubleshooting
Never expose the webhook secret in the dashboard after initial creation and never paste it into issue trackers.
5. Verification & Next Steps
Maintain a documented rollback plan for webhook endpoint changes.