Per-endpoint HMAC secret prefixed with whsec_. Used to verify Standard Webhooks headers (webhook-id, webhook-timestamp, webhook-signature). Shown once on create; rotatable with a dual-sign grace window.
Core concepts