Skip to content

Webhook HMAC Secret

Service Name: Webhook HMAC Authentication

Service Description: Webhook HMAC (Hash-based Message Authentication Code) secrets are used to verify the authenticity and integrity of webhook payloads. These secrets are used to create and validate signatures for webhook events, ensuring that the webhook requests are coming from the expected source and haven't been tampered with.

Service Address: Various services that support webhook HMAC authentication (GitHub, Stripe, Shopify, etc.)

Validation Type: API Auth

IP Allow list: IP restrictions are typically configured at the service level, not at the secret level. Many webhook providers allow you to restrict which IP addresses can send webhooks to your endpoints.

Secret Access Scope: Allows verification of webhook payloads. Does not grant direct access to resources but is used to validate the authenticity of incoming webhook requests.

Secret Revokement URL: Varies by service provider. Typically found in the webhook or developer settings section of each service.

Secret Example: whsec_8fh4f8h48fh84hf84hf84hf84hf84hf84hf84hf84hf84hf84h

Suspicious Activity Investigation Instructions:

  • Check server logs for webhook requests with invalid signatures.
  • Look for unusual webhook request patterns or volumes.
  • Verify if webhook endpoints are receiving requests from unexpected IP addresses.
  • Review application logs for any actions triggered by webhook events.
  • Check if webhook payloads contain unexpected or malicious data.

Mitigation Instructions:

  • Rotate the webhook secret immediately in the service provider's dashboard.
  • Update the secret in all applications or services that validate the webhooks.
  • Consider implementing IP restrictions for webhook endpoints if supported.
  • Review and update webhook endpoint security configurations.
  • Implement proper error handling for webhook signature validation failures.
  • Consider implementing rate limiting for webhook endpoints.
  • Monitor webhook traffic for a period after rotating the secret to ensure normal operation.