> ## Documentation Index
> Fetch the complete documentation index at: https://rain-sandbox-trial.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Create a secondary signing API key for webhook signatures

> Creates a new secondary signing API key that can be used to sign webhook requests. This endpoint is used for API key rotation - the secondary key will be used alongside the primary key to sign webhooks, allowing you to update your systems before promoting the secondary key to primary.



## OpenAPI

````yaml /openapi.json post /issuing/webhooks/apikey/secondary
openapi: 3.0.3
info:
  title: Issuing API
  description: This is the specification for Rain's Issuing API.
  termsOfService: https://www.rain.xyz/legal/authorized-user-terms
  contact:
    email: support@rain.xyz
  version: 1.3.0
servers:
  - url: https://api-dev.rain.xyz/v1
    description: Sandbox server
  - url: https://api.rain.xyz/v1
    description: Production server
security: []
tags:
  - name: paymentRoutes
    description: >-
      **Endpoint Migration:** The `/v1/automations` endpoints have been renamed
      to `/v1/payment-routes`. The old `/v1/automations` paths remain available
      as deprecated aliases during migration. Update your integrations to use
      `/v1/payment-routes` as the deprecated endpoints will be removed in a
      future release.
  - name: simulate
    description: >-
      Transaction simulation endpoints for testing integration flows in
      non-production environments. These endpoints let you trigger transaction
      events programmatically to automate integration tests and verify webhook
      handling without depending on external systems or staging real deposits.
      **Sandbox only** — all simulation endpoints return `404 Not Found` in
      production.
  - name: raindrops
    description: >-
      Rewards and points management endpoints. Custom API keys need
      `raindrops:read`/`raindrops:write` for general rewards endpoints and
      `raindrops-travel:read`/`raindrops-travel:write` for travel redemption
      endpoints.
    x-group: rewards
paths:
  /issuing/webhooks/apikey/secondary:
    post:
      tags:
        - webhooks
      summary: Create a secondary signing API key for webhook signatures
      description: >-
        Creates a new secondary signing API key that can be used to sign webhook
        requests. This endpoint is used for API key rotation - the secondary key
        will be used alongside the primary key to sign webhooks, allowing you to
        update your systems before promoting the secondary key to primary.
      operationId: createSecondarySigningApiKey
      requestBody:
        description: Empty request body
        required: true
        content:
          application/json:
            schema:
              type: object
              properties: {}
      responses:
        '200':
          description: Successful operation
          content:
            application/json:
              schema:
                type: object
                required:
                  - currentSigningApiKey
                  - newSecondarySigningApiKey
                properties:
                  currentSigningApiKey:
                    type: object
                    description: The current primary signing API key
                    required:
                      - id
                      - name
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The id of the current primary signing API key
                      name:
                        type: string
                        description: The name of the current primary signing API key
                  newSecondarySigningApiKey:
                    type: object
                    description: The newly created secondary signing API key
                    required:
                      - id
                      - name
                      - key
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The id of the new secondary signing API key
                      name:
                        type: string
                        description: The name of the new secondary signing API key
                      key:
                        type: string
                        description: >-
                          The actual API key value (only returned once during
                          creation)
        '400':
          description: >-
            Bad request - either no primary signing API key exists, or a
            secondary signing API key already exists
        '401':
          description: Invalid authorization
        '403':
          description: Forbidden
        '404':
          description: Tenant not found
        '500':
          description: Internal server error
      security:
        - ApiKeyAuth: []
components:
  securitySchemes:
    ApiKeyAuth:
      type: apiKey
      name: Api-Key
      in: header

````