MARKETPLACE
PLUGINS
SECRET VALIDATOR
Secret Validator logo

Secret Validator

Published June 2026
   •    Updated this month

Plugin details

Securely validate webhooks, API signatures and incoming secret tokens right inside your Bubble workflows. Secret Validator provides a lightweight, server-side action designed to perform cryptographic validations — such as HMAC signatures or token verification — without ever exposing your sensitive keys or private credentials to the client. Keep your external integrations tight, secure and fully verified.
Key Features:
🔒 Secure Server-Side Validation: Processes your verification tokens exclusively on the server to prevent data leaks.

⚡ Ultra-Fast Execution: Highly optimised logic with zero unnecessary dependencies for lightning-fast workflow speeds.

✅ Simple Contract: Pass the incoming value, get a single is_valid boolean back, and branch your workflow on it.

🤝 Seamless Integration: Perfect for verifying webhooks from third-party platforms such as Stripe, GitHub, Shopify or your own APIs before processing the data.

🛡️ Fail Closed: Put it first in your backend workflow so unverified requests never reach the steps that write data.

Plugin support: https://inova.us/support

Free

For everyone

stars   •   0 ratings
2 installs  
This plugin does not collect or track your personal data.

Other actions

Platform

Web & Native mobile

Contributor details

Inova Studio logo
Inova Studio
Joined 2017   •   24 Plugins
View contributor profile

Instructions

Setup Instructions
Secret Validator allows you to securely verify incoming webhooks or API request signatures entirely on the server-side using a shared secret key.

1. Add Your Secret Key
Before using the action, you must provide your private endpoint secret (provided by Stripe, GitHub, Shopify, etc.):
  • Go to the Plugins tab in your Bubble app settings.
  • Locate Secret Validator.
  • Enter your private key into the designated Secret input field (make sure to set it for both development and production versions if applicable). This keeps your key safely hidden on the server.

2. Add the Action to your Workflow
In your backend workflows (usually an API Workflow built to handle incoming webhooks), add the Secret Validator server-side action as the very first step.

3. Configure the Workflow Fields
The action requires the following parameters:
  • Payload / Body: The raw string or text body received from the webhook provider.
  • Signature / Token: The signature header sent by the provider (e.g., X-Hub-Signature or Stripe-Signature) that you need to validate.

4. Handle the Result
The action will output a boolean value.
  • Add a Conditional Decision (Only when...) to your subsequent workflow steps.
  • Only allow your workflow to process data if the result of the validation step is "yes".
  • If the result is "no", terminate the workflow or return a 401 Unauthorized response to block malicious requests.

Types

This plugin can be found under the following types:
Action

Categories

This plugin can be found under the following categories:
Technical   •   Data (things)

Resources

Support contact
Tutorial

Rating and reviews

No reviews yet

This plugin has not received any reviews.
Bubble logo
Product
AI
Mobile
Design
Data
Logic
Collaboration
Security
Status
Release notes
Bubble for
Founders
Developers
Agencies
Enterprise
Discover
How Bubble works
Examples
Bubble is Global
Pricing
Learn
Academy
Technical guides
Blog
How to build
Coaching
Resources
Connect to AI
Marketplace
Templates
Plugins
Experts
Bootcamps
Certification
Partnerships
Affiliates
Figma to Bubble
Community
Bubble community
Forum
Newsletter
Podcast
Ideaboard
Early access
Company
About
Careers
Brand guidelines
Support
Contact us
Legal
Terms
Privacy
©  2026, Bubble Group, Inc. All rights reserved.
Bubble
Pricing
Enterprise
Contact sales