---
title: "Webhook Signing Secrets: Accept Only Signed Requests"
description: "Make a signing secret, give it to the service that sends your webhooks, and have an automation start only for requests that really came from it."
section: "Automations"
canonical: "https://banksync.io/docs/automations/webhook-signing-secrets"
specs: ["connections"]
operationBindings: [{"capability":"connections","operation":"connections.list"},{"capability":"connections","operation":"connections.create"},{"capability":"connections","operation":"connections.reauthorise"},{"capability":"connections","operation":"connections.revoke"}]
---

An automation that starts **On a webhook** has a secret link: anyone who has the link can start it
(see [Webhooks](/docs/automations/automations-webhooks)). A **signing secret** closes that gap. You give the secret to the service that sends the webhook
(Svix, Clerk, Resend, your own app); it signs every request with it; and your automation starts only
for requests whose signature checks out. Everything else is refused before a run starts.

Automations are in preview: signing secrets are there wherever automations are enabled.

## Make one while you build

1. Open the automation and select its **On a webhook** start.
2. Under **Check the sender**, set **How the sender signs** — **Standard Webhooks** (Svix, Clerk,
   Resend and many others) or **HMAC SHA-256** (a `sha256=` signature with a timestamp header).
3. In **Signing secret**, pick **Create a signing secret**, give it a name you will recognise
   ("Billing events"), and either let BankSync **generate one for you** or paste **the secret the
   sender gave you** (a Standard Webhooks `whsec_…` secret, for example).
4. A generated secret is shown **once**. Copy it into the sender's webhook settings, then choose
   **I've saved it**. The new secret is picked for you.
5. Publish the automation. From then on only signed requests start it.

Only a workspace admin can create, rotate or revoke a signing secret. Anyone who can edit the
automation can pick one that already exists.

## Manage your secrets

**Settings → Developers → Signing secrets** lists every secret with when it was made and last
changed. BankSync never shows a secret again after it is saved, anywhere.

- **Rotate** gives a secret a new value (generated or pasted) and refuses the old one at once.
  Update the sender straight after, or its requests are refused.
- **Revoke** destroys a secret for good. Before you confirm, BankSync names every automation that
  checks senders with it: each stops accepting webhooks until you pick another secret in its start.

Every create, rotation and revocation is recorded with who made it.

## When a request is refused

A request with no signature, a signature made with another secret, or one older than the
tolerance you set (five minutes by default) is answered `401` and starts nothing. A sender that
retries a request it already delivered is answered `202` and starts nothing twice.

If every request is refused after you rotate a secret, the sender is still signing with the old
one: paste the new secret into the sender's settings.