Changelog - Webhook Signing Secrets

Added signing secrets to the Webhooks API

Oct 6, 2026

Webhooks can now be signed with a dedicated signing secret instead of your API key. The POST /webhooks and PUT /webhooks/{id} endpoints accept two new optional fields:

signing_secret: Provide your own secret (16 to 256 characters).
generate_signing_secret: Set to true to have Thinkific generate a secret for you. On update, this rotates the webhook's existing secret.

These two fields cannot be used together. A request that includes both returns a 422 Unprocessable Entity error.

When a signing secret is set, generated, or rotated, it is returned in the signing_secret field of that create or update response. It is never returned by GET /webhooks or GET /webhooks/{id}, so store it when you receive it.

Existing webhooks without a signing secret continue to be signed with your API key, and no changes are required.

This feature is being rolled out gradually and may not be enabled for your site yet. Until it is, these fields are ignored. Check the response for a signing_secret field to confirm it took effect.

See the Webhooks API Reference for full details.