feat(webhooks): add rotateSigningSecret()

[gabrielmfern]

Adds resend.webhooks.rotateSigningSecret(id) for POST /webhooks/{webhook_id}/signing-secret/rotate. The response is the create webhook shape (object, id, signing_secret), so the new interface file copies that. Follows webhooks.events.replay() from #1087 for layout, exports, test, and the minor version bump. Spec: resend/resend-openapi#113. Tracking: https://linear.app/resend/issue/DEV-2071.

Claude wrote a script against staging from dist/ that creates a webhook, rotates its secret, removes it, then rotates again to hit the 404.

live-rotate.mjs

import { Resend } from './dist/index.mjs';
const resend = new Resend(process.env.KEY);
const created = await resend.webhooks.create({ endpoint: 'https://example.com/rotate-test', events: ['email.sent'] });
console.log('create', JSON.stringify({ ...created.data, signing_secret: created.data?.signing_secret?.slice(0, 10) + '...' }), created.error);
const rotated = await resend.webhooks.rotateSigningSecret(created.data.id);
console.log('rotate', JSON.stringify({ ...rotated.data, signing_secret: rotated.data?.signing_secret?.slice(0, 10) + '...' }), rotated.error);
console.log('secret changed:', created.data.signing_secret !== rotated.data?.signing_secret);
const removed = await resend.webhooks.remove(created.data.id);
console.log('remove', JSON.stringify(removed.data), removed.error);
const missing = await resend.webhooks.rotateSigningSecret(created.data.id);
console.log('rotate deleted', missing.data, JSON.stringify(missing.error));

create {"object":"webhook","id":"ecfdedd6-997f-4ed0-a018-bfa06cf1ddea","signing_secret":"whsec_TO33..."} null
rotate {"object":"webhook","id":"ecfdedd6-997f-4ed0-a018-bfa06cf1ddea","signing_secret":"whsec_wRiK..."} null
secret changed: true
remove {"object":"webhook","id":"ecfdedd6-997f-4ed0-a018-bfa06cf1ddea","deleted":true} null
rotate deleted null {"statusCode":404,"message":"Webhook endpoint not found","name":"not_found"}

🤖 Generated with Claude Code

---

Summary by cubic

Adds resend.webhooks.rotateSigningSecret(id) so users can rotate a webhook's signing secret through the SDK, which previously had no method for this endpoint.

New Features

• Calls POST /webhooks/{webhook_id}/signing-secret/rotate.
• Returns the webhook with the new signing_secret, matching the create webhook response shape.
• Rotating a deleted or missing webhook returns a 404 error.

^{Written for commit 3f2146e. Summary will update on new commits.}

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/resend@1089

commit: 3f2146e

[klotty]

No issues found across 5 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Auto-approved: Adds a new SDK method, resend.webhooks.rotateSigningSecret, that calls the existing rotate endpoint with matching interfaces and tests. Additive, well-tested feature with no changes to existing behavior or operational tradeoffs.

Re-trigger cubic</sub>