---
title: Create or replace a webhook secret
description: Mint the bearer secret a webhook needs before it accepts payloads, copy it once, and rotate it when it is lost or exposed.
sidebar:
  order: 2
area: settings
feature: webhooks
appPath: /settings/general/webhooks
lastVerified: 2026-10-22
version: "2026-10-16"
audience: admin
related:
  - settings/webhooks
  - flows/forms
intercom:
  - id: "16858360"
    title: Create a Webhook (Pyn 2)
    url: https://intercom.help/pyn/en/articles/16858360-create-a-webhook-pyn-2
    note: draws on
---

A webhook is created on a form but accepts nothing until it has a secret. You mint the secret from the webhook's panel, copy it into the calling system, and replace it if it leaks or the other system loses it. The secret is shown once and cannot be read back.

## Before you start

- You are an admin or owner.
- The webhook exists. If not, open the form in [Forms](https://support.pynhq.com/flows/forms/), select **Settings** in the rail and then **Add Webhook**.
- You have somewhere safe to paste the secret, such as the calling system's credential store.

![Settings > General > Webhooks lists every inbound webhook created on a form.](https://support.pynhq.com/media/settings/webhooks/settings-webhooks-list.png)

## Steps

1. In Pyn, open **Settings** in the left navigation, then **Webhooks** under **General**.

2. Select the webhook. Its panel opens; without a secret it says "This webhook accepts nothing until it has a secret."

3. Select **Create Secret**. The panel shows the secret with "Copy this secret now. It is shown once and cannot be retrieved later."

4. Copy it, store it in the calling system, then select **Done**.

5. Copy the **URL** shown under "Post a JSON body here, with the secret as a bearer token." and configure the caller to send `Authorization: Bearer <secret>` with a JSON body.

6. To rotate later, select **Replace Secret**. The confirmation warns "The current secret stops working immediately. Anything calling this webhook will need the new one." Select **Replace** and copy the new value.

> **Caution:** Replacing takes effect the moment you confirm. Update the calling system straight after, or its next payload is refused.

## What you should see

With a secret in place the panel reads "This webhook already has a secret. Replace it if the old one has been lost." Send a test payload from the other system: the **History** tab lists it within a few seconds with its outcome, `submitted` for a payload that became a submission, or a reason code such as `unknown-subject`. A payload sent with a wrong or missing secret is answered `404` and does not appear in the log.

## Related

- [Webhooks](https://support.pynhq.com/settings/webhooks/) for the payload shape and outcome codes.
- [Forms](https://support.pynhq.com/flows/forms/) to create the webhook and set its subject.

## Related Intercom articles

- [Create a Webhook (Pyn 2)](https://intercom.help/pyn/en/articles/16858360-create-a-webhook-pyn-2) — draws on