title: Why does Stripe not use public-key cryptography for signing webhooks?
body: <p>From the <a href="https://stripe.com/docs/webhooks/signatures" rel="nofollow noreferrer">docs</a>:</p>
  <blockquote>
  <p>Stripe can optionally sign the webhook events it sends to your endpoints by including a signature in each event’s Stripe-Signature header. This allows you to verify that the events were sent by Stripe, not by a third party. You can verify signatures either using our official libraries, or manually using your own solution.</p>
  </blockquote>
  <blockquote>
  <p>Before you can verify signatures, you need to retrieve your endpoint’s secret from your Dashboard’s Webhooks settings. Select an endpoint that you want to obtain the secret for, then click the Click to reveal button.</p>
  </blockquote>
  <p>The last paragraph suggests that the secret is truly something to be treated confidentially. <strong>Is there a reason why Stripe doesn't use a private-public key scheme for signing webhook events?</strong></p>
  <p>They could keep the private key in their DB, never displaying it on the UI. The UI would only show the public key. Every request made to a webhook by Stripe would be signed with the private key and verified at the receiving end with the public key. This way, malicious actors getting access to the public key would be irrelevant, as they could only use it for verification, whereas now — I assume — an accidentally revealed secret can be used for forgery.</p>