Webhook secret
A webhook secret is a shared value a service gives you so your code can verify that an incoming webhook request genuinely came from that service, usually by checking a signature included in the request headers against the secret.
Why it matters
Without checking the signature, any webhook endpoint you expose could accept forged requests from anyone who guesses the URL, since the URL itself is not a secret.
Is a webhook secret the same as an API key?
It serves a different purpose, verifying incoming requests rather than authenticating outgoing ones, but it should be protected just as carefully.
What happens if a webhook secret leaks?
Someone could forge requests to your endpoint that pass signature verification, so it should be rotated immediately.
Related
Looking for a different way to manage your keys? See the best Claude Code API key manager alternatives, or browse every term in the glossary.