Webhook Signing Secrets: Accept Only Signed Requests

An automation that starts On a webhook has a secret link: anyone who has the link can start it (see Webhooks). A signing secret closes that gap. You give the secret to the service that sends the webhook (Svix, Clerk, Resend, your own app); it signs every request with it; and your automation starts only for requests whose signature checks out. Everything else is refused before a run starts.

Automations are in preview: signing secrets are there wherever automations are enabled.

Make one while you build#

1. Open the automation and select its On a webhook start.
2. Under Check the sender, set How the sender signs — Standard Webhooks (Svix, Clerk, Resend and many others) or HMAC SHA-256 (a sha256= signature with a timestamp header).
3. In Signing secret, pick Create a signing secret, give it a name you will recognise ("Billing events"), and either let BankSync generate one for you or paste the secret the sender gave you (a Standard Webhooks whsec_… secret, for example).
4. A generated secret is shown once. Copy it into the sender's webhook settings, then choose I've saved it. The new secret is picked for you.
5. Publish the automation. From then on only signed requests start it.

Only a workspace admin can create, rotate or revoke a signing secret. Anyone who can edit the automation can pick one that already exists.

Manage your secrets#

Settings → Developers → Signing secrets lists every secret with when it was made and last changed. BankSync never shows a secret again after it is saved, anywhere.

• Rotate gives a secret a new value (generated or pasted) and refuses the old one at once. Update the sender straight after, or its requests are refused.
• Revoke destroys a secret for good. Before you confirm, BankSync names every automation that checks senders with it: each stops accepting webhooks until you pick another secret in its start.

Every create, rotation and revocation is recorded with who made it.

When a request is refused#

A request with no signature, a signature made with another secret, or one older than the tolerance you set (five minutes by default) is answered 401 and starts nothing. A sender that retries a request it already delivered is answered 202 and starts nothing twice.

If every request is refused after you rotate a secret, the sender is still signing with the old one: paste the new secret into the sender's settings.