Webhook secret
To authenticate an incoming webhook message, an HMAC signature in an HTTP header and a shared secret are sometimes used. GitHub, Stripe, and Facebook use this technique to prevent spoofing.
On this page
Source content checked . English translation published 2026-10-27.
In business automation
A webhook secret is used for authentication between the sender and receiver, usually together with a signature according to the service's protocol. The goal is to check that the request came from an authorized source, not merely that it reached the correct address.
Examples
These examples illustrate a possible workflow. Adapt the connections and rules to your own systems.
Business process example
An order event arrives at a server. Before processing it, the server computes or verifies a signature against the original body and the service's instructions, rejects a modified request, and only then saves the event.
Relevant tools
- Shopify
- Event verification requires following the store platform's documented signature mechanism.
What to check
- Do not rely on checking a field the sender can invent. Verify the signature mechanism, timestamp, and how the request body is read.