# Resend webhook setup: endpoint, events, secret
To receive real-time events, you need a POST endpoint in your app and a webhook registered in Resend pointing at it.
## Steps
1. Build the endpoint first: a route that accepts POST, verifies the signature, and returns 200. See the signature-verification skill before you go live.
2. Create the webhook via the API, not the dashboard. It is faster, less error-prone, and the signing secret comes back in the response:
create with an `endpoint` URL and an `events` array, e.g. email.delivered, email.bounced, email.received.
3. Store the `signing_secret` from the create response as an environment variable immediately. It starts with whsec_ and is only returned once. If you lose it, rotate it.
4. Subscribe only to the events you actually handle. A webhook subscribed to everything becomes a noisy endpoint you stop trusting.
5. For local development, expose your machine with a tunnel (ngrok or Tailscale Funnel) and point the webhook at the tunnel URL.
## The trap
Creating the webhook in the dashboard, closing the tab, and losing the signing secret. Without it you cannot verify signatures, and an unverified endpoint cannot be trusted. The other trap is the Node SDK method name: it is `resend.webhooks.remove(id)` to delete a webhook, not `.delete()`. And when you rotate a signing secret, payloads are dual-signed with both secrets for 24 hours, so your verifier must accept any valid v1 signature during the window.