diff --git a/services/webhook.py b/services/webhook.py
index 4535ce3b..efd3c451 100644
--- a/services/webhook.py
+++ b/services/webhook.py
@@ -14,7 +14,7 @@ from orm.author import Author
 from resolvers.stat import get_with_stat
 from services.db import local_session
 from services.schema import request_graphql_data
-from settings import ADMIN_SECRET
+from settings import ADMIN_SECRET, WEBHOOK_SECRET
 
 
 async def create_webhook_endpoint():
@@ -33,14 +33,19 @@ async def create_webhook_endpoint():
             "event_name": "user.login",
             "endpoint": "https://core.dscrs.site/new-author",
             "enabled": True,
+            "headers": {
+                "Authorization": WEBHOOK_SECRET
+            },
         }
     }
     gql = {
-        "query": f"query {operation}($params: AddWebhookRequest!)  {{"
+        "query": f"query {operation}($params: AddWebhookRequest!)"
+        + "{"
         + f"{query_name}(params: $params) {{ message }} "
         + "}",
         "variables": variables,
         "operationName": operation,
+
     }
     result = await request_graphql_data(gql, headers=headers)
     logger.info(result)
diff --git a/settings.py b/settings.py
index 96198af6..266b22f7 100644
--- a/settings.py
+++ b/settings.py
@@ -15,3 +15,4 @@ DEV_SERVER_PID_FILE_NAME = "dev-server.pid"
 MODE = "development" if "dev" in sys.argv else "production"
 
 ADMIN_SECRET = environ.get("AUTH_SECRET") or "nothing"
+WEBHOOK_SECRET = environ.get("WEBHOOK_SECRET") or "nothing-else"
\ No newline at end of file