diff --git a/app.py b/app.py
index 23422ea..f85722b 100644
--- a/app.py
+++ b/app.py
@@ -12,6 +12,7 @@ BTCPAY_URL = os.environ.get("BTCPAY_URL", "https://10.30.20.140")
 BTCPAY_STORE = os.environ.get("BTCPAY_STORE", "FDT6DHWEaA7DF5WFePkp4pufgQ9yy1G6JfzTCwey1jYn")
 BTCPAY_KEY = os.environ.get("BTCPAY_KEY", "206f08d0a8efc4cfbe524188756c5bd1b2fd277a")
 PRICE_USD = os.environ.get("PRICE_USD", "5.00")
+WEBHOOK_SECRET = os.environ.get("WEBHOOK_SECRET", "pn-nocturne-webhook-secret-1788251891")
 
 app = Flask(__name__)
 
@@ -73,6 +74,10 @@ def unlock():
 @app.route("/webhook/btcpay", methods=["POST"])
 def webhook():
     raw = request.get_data()
+    sig = request.headers.get("BTCPay-Sig", "")
+    exp = "sha256=" + hmac.new(WEBHOOK_SECRET.encode(), raw, hashlib.sha256).hexdigest()
+    if not hmac.compare_digest(exp, sig):
+        return "bad sig", 401
     data = json.loads(raw) if raw else {}
     etype = data.get("type", "")
     order_id = (data.get("metadata") or {}).get("orderId")