# Webhook secret

Canonical page: /glossary/webhook-secret

API keys & secrets glossary, Keys & secrets. Webhook Secret: Verifying a Request Actually Came From the Service

**Short answer:** A webhook secret is a shared value a service gives you so your code can verify that an incoming webhook request genuinely came from that service, usually by checking a signature included in the request headers against the secret.

## Why it matters

Without checking the signature, any webhook endpoint you expose could accept forged requests from anyone who guesses the URL, since the URL itself is not a secret.

## In Claude Keychain

A webhook secret is stored in Claude Keychain the same way any other credential is: once, under a clear name, and injected into whatever process verifies incoming requests when it needs to check a signature.

## Common questions

**Is a webhook secret the same as an API key?**

It serves a different purpose, verifying incoming requests rather than authenticating outgoing ones, but it should be protected just as carefully.

**What happens if a webhook secret leaks?**

Someone could forge requests to your endpoint that pass signature verification, so it should be rotated immediately.

## Related

[API key](/glossary/api-key), [JWT (JSON Web Token)](/glossary/jwt), [Hardcoded secret](/glossary/hardcoded-secret)