feat(webhooks): add signing secret rotation endpoint

[gabrielmfern]

Adds resend.Webhooks.rotate_signing_secret(webhook_id) and its async twin for POST /webhooks/{webhook_id}/signing-secret/rotate, returning RotateSigningSecretResponse with the same object, id, signing_secret shape as create webhook. Mirrors the event replay endpoint from #274 in layout, tests, and the examples/webhooks.py walkthrough.

Spec: resend/resend-openapi#113
Linear: https://linear.app/resend/issue/DEV-2072

🤖 Generated with Claude Code

---

Summary by cubic

Adds a signing secret rotation endpoint so users can rotate a webhook's signing secret without recreating it.

• Adds resend.Webhooks.rotate_signing_secret(webhook_id) and the async twin rotate_signing_secret_async.
• Returns a new RotateSigningSecretResponse with the same object, id, and signing_secret shape as the create webhook response.
• Mirrors the existing event replay endpoint in structure, tests, and the examples/webhooks.py walkthrough.

^{Written for commit 482dd5d. Summary will update on new commits.}

[cubic-dev-ai]

2 issues found across 4 files

Confidence score: 2/5

• examples/webhooks.py prints rotated['signing_secret'], exposing the webhook signing secret through stdout and captured logs; print only the webhook ID or omit the output.
• Webhooks.rotate_signing_secret may require permissions that existing production RESEND_API_KEY values do not have, potentially preventing rotation after deployment; verify API-key permissions before deployment.

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="examples/webhooks.py">

<violation number="1" location="examples/webhooks.py:88">
P2: Custom agent: **API Key Permission Check SDK Methods**

Confirm that existing production `RESEND_API_KEY` values have the permissions required for `Webhooks.rotate_signing_secret` before deployment; otherwise this new operation can fail with an authorization error after release.</violation>

<violation number="2" location="examples/webhooks.py:90">
P1: Do not print `rotated['signing_secret']` because this exposes the webhook signing secret in stdout and any captured logs. Print only the webhook ID or omit this output.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Do not print rotated['signing_secret'] because this exposes the webhook signing secret in stdout and any captured logs. Print only the webhook ID or omit this output.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At examples/webhooks.py, line 90:

<comment>Do not print `rotated['signing_secret']` because this exposes the webhook signing secret in stdout and any captured logs. Print only the webhook ID or omit this output.</comment>

<file context>
@@ -84,6 +84,11 @@
+rotated: resend.Webhooks.RotateSigningSecretResponse = (
+    resend.Webhooks.rotate_signing_secret(webhook["id"])
+)
+print(f"Rotated signing secret: {rotated['signing_secret']}")
+
 rm_webhook: resend.Webhooks.DeleteWebhookResponse = resend.Webhooks.remove(
</file context>

Suggested change

	print(f"Rotated signing secret: {rotated['signing_secret']}")
	print(f"Rotated signing secret for webhook: {rotated['id']}")

[cubic-dev-ai]

P2: Custom agent: API Key Permission Check SDK Methods

Confirm that existing production RESEND_API_KEY values have the permissions required for Webhooks.rotate_signing_secret before deployment; otherwise this new operation can fail with an authorization error after release.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At examples/webhooks.py, line 88:

<comment>Confirm that existing production `RESEND_API_KEY` values have the permissions required for `Webhooks.rotate_signing_secret` before deployment; otherwise this new operation can fail with an authorization error after release.</comment>

<file context>
@@ -84,6 +84,11 @@
     print("No webhook events available")
 
+rotated: resend.Webhooks.RotateSigningSecretResponse = (
+    resend.Webhooks.rotate_signing_secret(webhook["id"])
+)
+print(f"Rotated signing secret: {rotated['signing_secret']}")
</file context>