The signing secret is used to compute HMAC-SHA256 signatures on every webhook delivery. Your receiving server uses it to verify that payloads are genuine and unmodified.
How Secrets Are Generated #
When you create a new endpoint, a 64-character hexadecimal secret is generated automatically using random_bytes(32). The full secret is shown once on the confirmation screen.
Storage Security #
Secrets are stored in the database encrypted with AES-256-CBC. The encryption key is derived from the WordPress auth salt. Secrets are never returned in plaintext through the admin UI or REST API after initial creation — they are masked as *{last4}.
If You Lose the Secret #
If the secret is lost, it cannot be recovered. You must rotate the key to generate a new one:
- Go to DDLS > Webhooks > Endpoints
- Click Edit on the affected endpoint
- Click Rotate Secret
- Copy the new secret displayed on screen
- Update your receiving server with the new secret within 24 hours
WordPress Salt Warning #
The encryption key is tied to your WordPress authentication salts. If WordPress salts are regenerated (e.g., via a security plugin), all stored secrets become unreadable. If this happens, all endpoints will need to be re-registered with new secrets.
Related Topics #
- Signing Secret Rotation
- Signature Verification
- Creating an Endpoint