<p><a href="https://stripe.com/docs/webhooks" rel="nofollow noreferrer">Webhooks</a> are like callback events. Basically when something happens on Stripe's side (eg a new customer created, a trial subscription cancelled, etc.) your application can get notified as well and take the appropriate action.</p>
<p>They're less useful when your application controls that entire process but in the case of subscriptions, let's say the customer's card declines after month 2. You definitely want to get notified when that happens and take the appropriate action since Stripe is taking care of those payments.</p>
<p>A <a href="https://stripe.com/docs/webhooks/signatures" rel="nofollow noreferrer">webhook signing secret</a> is optional but it's basically a signature for verifying that whatever webhook Stripe is sending is legit. Stripe uses a secret key that Commerce can use to verify that Stripe was the really author of that webhook call which can help prevent things like <a href="https://en.wikipedia.org/wiki/Replay_attack" rel="nofollow noreferrer">replay attacks</a>.</p>
<p>It's less useful in the case of smaller applications but if you're building something with Stripe Connect where multiple users can authenticate, get payouts, etc. it becomes essential.</p>
<p>In the case of security, nothing is ever binary. Much like CSRF protection, you want layers of an onion and signing secrets provide another layer of protection.</p>

CC BY-SA 4.0
2020-10-04T18:37:43.237Z
2020-10-04T18:37:43.237Z
RitterKnight
<p>I could not find any documentation on the 'Webhook Signing Secret' used in Commerce Settings &gt; Gateway &gt; Stripe Gateway. Can someone tell me what this is, what it's used for and typically what I should be entering as a value? Not sure if this is even required? References or insight most appreciated.</p>

<plugin-craftcommerce>
What is a Webhook Signing Secret?
# What is a Webhook Signing Secret?

(Asked by: username_0 on 2020-10-02)

I could not find any documentation on the 'Webhook Signing Secret' used in Commerce Settings > Gateway > Stripe Gateway. Can someone tell me what this is, what it's used for and typically what I should be entering as a value? Not sure if this is even required? References or insight most appreciated.

**Tags:** plugin-craftcommerce

---

## 1 answers

### Answer by username_1 on 2020-10-04. Score: 2

[Webhooks](https://stripe.com/docs/webhooks) are like callback events. Basically when something happens on Stripe's side (eg a new customer created, a trial subscription cancelled, etc.) your application can get notified as well and take the appropriate action.

They're less useful when your application controls that entire process but in the case of subscriptions, let's say the customer's card declines after month 2. You definitely want to get notified when that happens and take the appropriate action since Stripe is taking care of those payments.

A [webhook signing secret](https://stripe.com/docs/webhooks/signatures) is optional but it's basically a signature for verifying that whatever webhook Stripe is sending is legit. Stripe uses a secret key that Commerce can use to verify that Stripe was the really author of that webhook call which can help prevent things like [replay attacks](https://en.wikipedia.org/wiki/Replay_attack).

It's less useful in the case of smaller applications but if you're building something with Stripe Connect where multiple users can authenticate, get payouts, etc. it becomes essential.

In the case of security, nothing is ever binary. Much like CSRF protection, you want layers of an onion and signing secrets provide another layer of protection.


---

