> ## Documentation Index
> Fetch the complete documentation index at: https://docs.os.default.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Webhook Secret

> The single bearer secret that authenticates every incoming webhook in your workspace.

Your workspace uses one **webhook secret** to authenticate every incoming webhook it
receives. Because the same secret covers all of your workspace's webhook ingestion URLs, it
lives here at the workspace level rather than on any individual webhook.

<Note>
  Open **Settings** from the **Dock** (the app bar at the bottom of the screen), then select
  **Webhook Secret** under **Workspace Settings**. This page is available to admins, and the
  card appears once your workspace has a webhook secret.
</Note>

## Use the secret

Send the secret as a Bearer token in the `Authorization` header, for example
`Authorization: Bearer <your-secret>`, on requests to any of your workspace's webhook
ingestion URLs. Requests sent without the correct secret are rejected.

## View and copy the secret

The secret is hidden by default and shown as dots.

<Steps>
  <Step title="Reveal it">
    Select the eye icon next to the secret to reveal it.
  </Step>

  <Step title="Copy it">
    Select the copy icon to copy the secret to your clipboard, then paste it into the
    configuration of the system that sends your webhooks.
  </Step>
</Steps>

## Rotate the secret

Rotating replaces the current secret with a new one. Use it if the secret may have been
exposed.

<Warning>
  Rotating re-keys every webhook in your workspace. The current secret stops working
  immediately, so every system that sends webhooks to Default must be updated with the new
  secret, or its requests will be rejected.
</Warning>

<Steps>
  <Step title="Select Rotate">
    Select **Rotate**. Default asks you to confirm with "Rotate webhook secret?"
  </Step>

  <Step title="Confirm">
    Select **Rotate secret** to confirm, or **Cancel** to back out. Default generates the new
    secret and confirms with "Webhook secret rotated."
  </Step>

  <Step title="Update your senders">
    Copy the new secret and update every system that sends webhooks to your workspace so their
    requests keep authenticating.
  </Step>
</Steps>