Custom Shared Secret

Shared secret (default) is the simplest mode. Wexio generates a random secret, the partner sends it as the x-webhook-secret header on every POST, and Wexio bcrypt-compares it on receive. There is no signature math and no timestamp tolerance.

Use it when:

• The partner is a no-code tool. Make, Zapier, n8n, IFTTT, Pabbly and Retool let you set arbitrary request headers.
• The partner is your own backend. You control both sides.
• No named mode fits. The partner supports neither HMAC nor a named provider mode, but can send a custom header.

Setup

1. Connect It in Wexio

Go to New connection → Inbound and leave Authentication mode on Shared secret (default).

Wexio generates a random secret and shows it once, on the screen after you create the connection. Copy it now. The connection page does not show it again. The Endpoint section lists the header name as Secret header (x-webhook-secret). If you lose the secret, rotate it (see below).

2. Set Up the Partner

Add the header x-webhook-secret with the generated value. How you do it depends on the tool.

• HTTP module, node or action: set the header, set Content-Type: application/json and send a JSON body.
• Webhook destination with a "custom headers" option: add x-webhook-secret there.
• Your own backend: add the header in your HTTP client when you POST.

3. Resolve Contacts and Bind a Flow

This is the same as for every inbound connection. Set the identifier and path, capture the schema, then bind a Webhook Received trigger.

Security Considerations

• The secret travels on the wire. HTTPS is your transport protection, so use this mode only over HTTPS.
• There is no per-body signature. A proxy that modifies the body (for example re-compresses it, reformats JSON or strips whitespace) does not break auth. It may break schema inference if the shape changes.
• Replay protection comes from idempotency. Send X-Idempotency-Key with a stable per-event ID on retries. Wexio dedupes replays within 24 hours.
• Rotate on compromise. If you suspect the secret leaked, open the ... menu in the header of the connection page and click Rotate secret. Confirm in Rotate webhook secret?. The old value stops working the moment you rotate, and the new secret is shown only right after the rotation, so copy it then.

When to Use a Named Provider Mode Instead

If the partner is Stripe, Slack, Svix, Paddle, Revolut, HubSpot, Mailgun, Zendesk, GitHub, Shopify or similar, use its chip under Provider presets. You get body-level signature verification, which protects against replay and tampering, and replay tolerance tuned to the provider's retry policy.

Troubleshooting

Was this page helpful?

😞😕😐🙂🤩

Related

• Inbound Webhooks - auth modes, contact resolution and response codes
• Custom HMAC - the option for partners that sign the body
• Webhook Received - the trigger that starts your flow
• Webhook History - check why a request failed