---
title: "Enable verification and set the signing secret"
method: PATCH
path: "/v1/endpoints/{id}/auth-config"
---

# Enable verification and set the signing secret

`PATCH /v1/endpoints/{id}/auth-config`

## Request

- Base URL: `https://webhook-studio.com`
- URL: `https://webhook-studio.com/v1/endpoints/{id}/auth-config`
- Auth: HTTP bearer

Set the PROVIDER's own secret (Stripe's whsec_..., GitHub's configured secret). A platform-generated secret can only verify traffic we signed ourselves. The scheme is detected from the header's shape, so there is no algorithm to configure.

## Request body

- object
  - `hmac_enabled` boolean
  - `secret` string
  - `header_name` string
  - `tolerance_seconds` integer
  - `on_failure` 'reject' | 'accept_log'
  - `log_blocked_ips` boolean

## Response `200`

OK

## Other responses

- `400`: Error
- `401`: Error
- `404`: Error

---

[API](https://skmtc.dev/webhook-studio/apis/webhook-studio-api.md) · [All operations](https://skmtc.dev/webhook-studio/apis/webhook-studio-api/llms.txt) · [OpenAPI document](https://skmtc.dev/webhook-studio/apis/webhook-studio-api/revisions/99d81099e6d6?raw)