resend-cli 2.19.1 → 2.20.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "resend-cli",
-  "version": "2.19.1",
+  "version": "2.20.1",
   "description": "The official CLI for Resend",
   "license": "MIT",
   "repository": {
@@ -46,7 +46,7 @@
     "esbuild": "0.28.1",
     "esbuild-wasm": "0.28.0",
     "picocolors": "1.1.1",
-    "resend": "6.26.0"
+    "resend": "6.27.0"
   },
   "pkg": {
     "scripts": [

package/skills/resend-cli/SKILL.md

@@ -13,7 +13,7 @@ metadata:
   author: resend
   # Skill version is independent from the CLI/package.json version —
   # bump it on skill content changes, not CLI releases.
-  version: "2.11.0"
+  version: "2.12.1"
   homepage: https://resend.com/docs/cli-agents
   source: https://github.com/resend/resend-cli
   openclaw:
@@ -145,7 +145,7 @@ Auth resolves: `RESEND_API_KEY` env > config file (`resend login --key`). Use `-
 | `segments` | create, get, list, update, delete, contacts |
 | `templates` | create, publish, duplicate, delete, list |
 | `topics` | create, update, delete, list |
-| `webhooks` | create, update, listen, delete, list, events (list, get, attempts, replay) |
+| `webhooks` | create, update, rotate-signing-secret, listen, delete, list, events (list, get, attempts, replay) |
 | `auth` | login, logout, switch, rename, remove |
 | `whoami` / `doctor` / `update` / `open` / `commands` | Utility commands |
 
@@ -158,7 +158,7 @@ Read the matching reference file for detailed flags and output shapes.
 | # | Mistake | Fix |
 |---|---------|-----|
 | 1 | **Forgetting `--yes` on delete commands** | All `delete`/`rm` subcommands require `--yes` in non-interactive mode — otherwise the CLI exits with an error |
-| 2 | **Not saving webhook `signing_secret`** | `webhooks create` shows the secret once only — it cannot be retrieved later. Capture it from command output immediately |
+| 2 | **Losing the webhook `signing_secret`** | `webhooks create` returns it, and `webhooks get` returns it again. Use `webhooks rotate-signing-secret` if it leaked |
 | 3 | **Omitting `--quiet` in CI** | Without `-q`, spinners and status text still go to stderr (not stdout). Use `-q` for JSON on stdout with no spinner noise on stderr |
 | 4 | **Passing `--scheduled-at` as a flag to batch** | There is no `--scheduled-at` flag on `emails batch` — set `scheduled_at` per-email in the JSON file instead |
 | 5 | **Expecting `domains list` to include DNS records** | List returns summaries only — use `domains get <id>` for the full `records[]` array |

package/skills/resend-cli/references/webhooks.md

@@ -26,7 +26,7 @@ Detailed flag specifications for `resend webhooks` commands.
 - Contact: `contact.created`, `contact.updated`, `contact.deleted`
 - Domain: `domain.created`, `domain.updated`, `domain.deleted`
 
-**Output includes `signing_secret`** — shown once only. Save immediately.
+**Output includes `signing_secret`.** `webhooks get` returns it again.
 
 ---
 
@@ -34,7 +34,7 @@ Detailed flag specifications for `resend webhooks` commands.
 
 **Argument:** `<id>` — Webhook ID
 
-**Note:** `signing_secret` is NOT returned by get (only at creation).
+Returns the webhook including its `signing_secret`.
 
 ---
 
@@ -60,6 +60,18 @@ Detailed flag specifications for `resend webhooks` commands.
 
 ---
 
+## webhooks rotate-signing-secret
+
+**Argument:** `<id>` — Webhook ID
+
+Generates a new signing secret. For 24 hours, payloads are signed with both the
+new and the previous secret, so either one verifies them. After that, only the
+new secret does.
+
+Returns `{"object":"webhook","id":"<uuid>","signing_secret":"whsec_..."}`.
+
+---
+
 ## webhooks events list
 
 Lists the events Resend delivered to a webhook, most recent first.

package/skills/resend-cli/references/workflows.md

@@ -165,7 +165,7 @@ resend webhooks create \
   --endpoint https://yourapp.com/webhooks/resend \
   --events email.delivered email.bounced email.complained
 
-# IMPORTANT: Save the signing_secret from output — shown once only
+# Use the signing_secret from output to verify payloads; "resend webhooks get" returns it again
 
 # Or subscribe to all events
 resend webhooks create \