How to add a webhook endpoint in Stripe and copy the signing secret
Open Workbench, then Webhooks, click Add destination, choose the events, pick Webhook endpoint, enter your URL and create it. Then click Reveal under Signing secret and copy the whsec_ value into your app.
This is for a developer wiring Stripe events into an app, usually because the code is written and the agent now needs a signing secret only the dashboard can give. You add a destination in Workbench, choose the events your code handles and paste your endpoint URL. Test mode and live mode each have their own endpoints and their own signing secrets, which is where most failures come from.
Before you start
You need a Stripe account with the Administrator or Developer role. Your endpoint must be reachable over https, for example https://example.com/webhooks/stripe.
- Time
- About 3 minutes
- Account
- Not walked yet
| Role | What it can do here |
|---|---|
| Administrator or Developer | Can create webhook endpoints and reveal their signing secrets. |
| Other roles | Generally cannot see Workbench or reveal secrets. |
-
1
Switch to test mode
Make sure the dashboard is in test mode or a sandbox, not live. Do the live endpoint as a separate pass once test works.
You should see: A test mode or sandbox banner across the top of the dashboard.
-
2
Open Workbench
Click Developers at the bottom left, then open Workbench, and click the Webhooks tab.
You should see: A Webhooks tab listing event destinations, empty if you have none.
-
3
Click Add destination
Click Add destination (it may read Create an event destination or Add endpoint).
You should see: A step asking which events to send, with a search box.
-
4
Choose the events
Search for and tick each event your code handles, such as checkout.session.completed, then click Continue.
You should see: The selected events listed, and a choice of destination type.
-
5
Choose Webhook endpoint
Select Webhook endpoint as the destination type and click Continue.
You should see: A form with Endpoint URL and an optional description.
-
6
Enter the URL and create
Enter your https endpoint URL, such as https://example.com/webhooks/stripe, and click Create destination.
You should see: The endpoint's page showing its URL, status and a Signing secret section.
-
7
Reveal and copy the signing secret
Under Signing secret click Reveal and copy the value that starts with whsec_. Put it in your app's secret store as the webhook secret, never in code or chat.
You should see: A value beginning whsec_.
If it does not work
Your app rejects every event with No signatures found matching the expected signature for payload. The whsec_ in your app belongs to another endpoint or the other mode, or your framework changed the raw body before verification. Copy the secret from this endpoint in this mode, and verify against the raw request body.
Events work locally but not after deploying. Locally you used the stripe listen secret. Production needs the dashboard endpoint's own whsec_, and a live endpoint needs the live mode secret.
Deliveries show 401, 403 or a redirect in the endpoint's event log. Your endpoint is behind authentication, CSRF protection or an http to https redirect. Exempt the webhook path and give Stripe the final https URL.
Stripe marks the endpoint as failing and emails you. Your endpoint must return a 2xx quickly. Acknowledge the event first and do slow work in a background job.
Questions
Where are webhooks in the new Stripe dashboard?
They moved into Workbench, which opens from the Developers menu at the bottom left of the dashboard. Open the Webhooks tab there. An endpoint is now called an event destination.
Why does my app say no signatures found matching the expected signature?
The secret in your app is not the one for this endpoint and mode. Each endpoint has its own whsec_ secret, and the test mode endpoint's secret is different from the live one. Copy the secret from the same endpoint, in the same mode, that is sending the event.
Which events should I select?
Only the ones your code handles. For subscriptions that is typically checkout.session.completed, customer.subscription.updated, customer.subscription.deleted and invoice.payment_failed. Selecting all events floods your endpoint.
How do I test the endpoint without a real payment?
In test mode, run stripe trigger checkout.session.completed with the Stripe CLI, or send a test event from the endpoint's page if offered. Locally, stripe listen forwards events and prints its own whsec_ secret, which differs from the dashboard one.
Can I see the signing secret again later?
Yes. Open the endpoint in Workbench and click Reveal under Signing secret. You can also roll it there if it leaked.
How we checked
Verified 11 Oct 2026 against the live interface on not walked yet.
Related guides
Ready to do it?
Run these 7 steps on your own Stripe page. Each step shows in a panel on the page, Next when you are ready.