Webhook Secret Generator

What is a Webhook Secret?

A webhook secret is a shared cryptographic key used to sign webhook payloads and verify their authenticity. When a service like GitHub, Stripe, or Shopify sends a webhook to your application, they include an HMAC signature computed using the webhook secret. Your application can then verify the signature to ensure the webhook genuinely came from the service and wasn't tampered with in transit.

Our webhook secret generator creates cryptographically secure secrets suitable for production webhook integrations. The webhook secret should be kept confidential and shared only between you and the webhook provider. Never expose webhook secrets in client-side code or public repositories.

How Webhook Signature Verification Works

Webhook Secret Usage by Service

Webhook Verification Examples

Here's how to verify webhook signatures using your webhook secret:

const crypto = require('crypto');

function verifyGitHubWebhook(payload, signature, secret) {
  const hmac = crypto.createHmac('sha256', secret);
  const digest = 'sha256=' + hmac.update(payload).digest('hex');
  
  return crypto.timingSafeEqual(
    Buffer.from(signature),
    Buffer.from(digest)
  );
}

// Usage
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-hub-signature-256'];
  const payload = JSON.stringify(req.body);
  const secret = process.env.WEBHOOK_SECRET;
  
  if (verifyGitHubWebhook(payload, signature, secret)) {
    // Webhook is authentic
    res.status(200).send('OK');
  } else {
    res.status(401).send('Unauthorized');
  }
});

import stripe
import os

# Stripe provides a helper library
stripe.api_key = os.environ['STRIPE_API_KEY']
endpoint_secret = os.environ['WEBHOOK_SECRET']

@app.route('/webhook', methods=['POST'])
def webhook():
    payload = request.data
    sig_header = request.headers.get('Stripe-Signature')
    
    try:
        event = stripe.Webhook.construct_event(
            payload, sig_header, endpoint_secret
        )
        # Webhook verified successfully
        return 'OK', 200
    except ValueError:
        return 'Invalid payload', 400
    except stripe.error.SignatureVerificationError:
        return 'Invalid signature', 401

Webhook Secret Best Practices

• Use sufficient length: Webhook secrets should be at least 32 characters (256 bits) for strong security against brute-force attacks.
• Store securely: Keep webhook secrets in environment variables or secret management systems, never in code or version control.
• Verify every webhook: Always verify webhook signatures before processing payloads. Never trust webhook data without verification.
• Use constant-time comparison: When comparing signatures, use timing-safe comparison functions to prevent timing attacks.
• Implement replay protection: Check timestamps in webhook headers and reject old requests (e.g., Stripe's timestamp verification).
• Rotate secrets periodically: Change webhook secrets on a schedule and after any suspected compromise.
• Use HTTPS only: Webhook endpoints should always use HTTPS to prevent man-in-the-middle attacks.
• Log verification failures: Track failed webhook verifications to detect potential attacks or misconfigurations.

Webhook Secret Generator FAQ

Related Secret Generators