Stripe webhook signing secret

ID stripe_webhook_secret

DatatypeNot PIIidentifierDraft

This record is a draft: it has not been reviewed yet and may be incomplete or wrong. Do not rely on it for compliance decisions. Help improve it (see CONTRIBUTING.md).

Secret with which a Stripe webhook endpoint verifies the signatures of the events it receives. Stripe documents that it starts with whsec_. The vendor does not document the length or the characters after the prefix; the regexp accepts letters and digits.

Parent datatype: Symmetric secret key symmetric_key
Categories: Secrets and credentials (passwords, keys, tokens)
Countries: Global (not tied to a country)
Languages: Common to most languages
Quality: 70/100 · missing: examples, mapping (Wikidata, Schema.org, ...), translation
Metacrafter rules: no detection rule yet
Supported by tools: Datadog Sensitive Data Scanner, GitGuardian, GitHub secret scanning

Regular expression

^whsec_[A-Za-z0-9]+$

Python re syntax.

Examples

Value	Description
whsec_ invalid	Prefix without the secret

Sources

doc: https://docs.stripe.com/webhooks/stripe-events

Use this record

Page URL: https://registry.apicrafter.io/datatype/stripe_webhook_secret
JSON: API v1 · legacy shape (used by metacrafter) · Markdown (for LLMs)
Improve it: edit data/datatypes/any/secrets/stripe_webhook_secret.yaml on GitHub