diff --git a/src/common/config.ts b/src/common/config.ts
index 39269cb..f1613b4 100644
--- a/src/common/config.ts
+++ b/src/common/config.ts
@@ -30,6 +30,7 @@ export class ConfigUtil {
         let ob11Default: OB11Config = {
             httpPort: 3000,
             httpHosts: [],
+            httpSecret: "",
             wsPort: 3001,
             wsHosts: [],
             enableHttp: true,
diff --git a/src/onebot11/server/postOB11Event.ts b/src/onebot11/server/postOB11Event.ts
index 62ce555..fc5fd62 100644
--- a/src/onebot11/server/postOB11Event.ts
+++ b/src/onebot11/server/postOB11Event.ts
@@ -6,6 +6,7 @@ import {WebSocket as WebSocketClass} from "ws";
 import {wsReply} from "./ws/reply";
 import {log} from "../../common/utils/log";
 import {getConfigUtil} from "../../common/config";
+import crypto from 'crypto';
 
 export type PostEventType = OB11Message | OB11BaseMetaEvent | OB11BaseNoticeEvent
 
@@ -39,18 +40,26 @@ export function postOB11Event(msg: PostEventType, reportSelf = false) {
         }
     }
     if (config.ob11.enableHttpPost) {
+        const msgStr = JSON.stringify(msg);
+        const hmac = crypto.createHmac('sha1', config.ob11.httpSecret);
+        hmac.update(msgStr);
+        const sig = hmac.digest('hex');
+        let headers = {
+            "Content-Type": "application/json",
+            "x-self-id": selfInfo.uin
+        }
+        if (config.ob11.httpSecret) {
+            headers["x-signature"] = "sha1=" + sig;
+        }
         for (const host of config.ob11.httpHosts) {
             fetch(host, {
                 method: "POST",
-                headers: {
-                    "Content-Type": "application/json",
-                    "x-self-id": selfInfo.uin
-                },
-                body: JSON.stringify(msg)
+                headers,
+                body: msgStr
             }).then((res: any) => {
-                log(`新消息事件HTTP上报成功: ${host} ` + JSON.stringify(msg));
+                log(`新消息事件HTTP上报成功: ${host} ` + msgStr);
             }, (err: any) => {
-                log(`新消息事件HTTP上报失败: ${host} ` + err + JSON.stringify(msg));
+                log(`新消息事件HTTP上报失败: ${host} `, err, msg);
             });
         }
     }
diff --git a/src/renderer/index.ts b/src/renderer/index.ts
index 18caeba..52b37f9 100644
--- a/src/renderer/index.ts
+++ b/src/renderer/index.ts
@@ -55,6 +55,14 @@ async function onSettingWindowCreated(view: Element) {
                 SettingSwitch('ob11.enableHttpPost', config.ob11.enableHttpPost, {'control-display-id': 'config-ob11-httpHosts'}),
             ),
             `<div class="config-host-list" id="config-ob11-httpHosts" ${config.ob11.enableHttpPost ? '' : 'is-hidden'}>
+                <setting-item data-direction="row">
+                    <div>
+                        <setting-text>HTTP 事件上报密钥</setting-text>
+                    </div>
+                    <div class="q-input">
+                        <input id="config-ob11-httpSecret" class="q-input__inner" data-config-key="ob11.httpSecret" type="text" value="${config.ob11.httpSecret}" placeholder="未设置" />
+                    </div>
+                </setting-item>
                 <setting-item data-direction="row">
                     <div>
                         <setting-text>HTTP 事件上报地址</setting-text>