Share Webhook Secrets Securely
Share webhook signing secrets and verification tokens through encrypted links that expire after use.
The problem
Webhook secrets are used to verify that incoming HTTP requests are legitimate. When these secrets are shared via Slack or email, anyone with access to the channel can forge webhook payloads. Compromised webhook secrets can lead to unauthorized data injection, fake payment notifications, or corrupted integrations.
How Vaulted helps
Vaulted encrypts your webhook secret client-side with AES-256-GCM and delivers it through a self-destructing link. The server never sees the plaintext secret, and the link expires after viewing. This ensures webhook verification remains intact because the secret was never exposed in transit.
How to do it
- Paste your webhook signing secret into Vaulted
- Set a view limit appropriate for the number of team members who need it
- Share the encrypted link with the developers configuring the integration
- They copy the secret into their webhook handler config, and the link expires