Optional. Select a Secret text credential holding the secret configured on your Bitbucket webhooks. When set, every incoming webhook request must carry a valid X-Hub-Signature header: the HMAC-SHA256 of the request body, hex-encoded and prefixed with sha256=, as sent by Bitbucket Cloud and Bitbucket Server / Data Center when a secret is configured on the webhook. Requests with a missing or invalid signature are rejected with HTTP 403. Leave empty to keep accepting unsigned requests. The same secret must be configured on every webhook pointing to this Jenkins instance.