diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6ceaf7d..7f6bcdc 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,11 @@
 
 Format mengikuti [Keep a Changelog](https://keepachangelog.com/) dan [Semantic Versioning](https://semver.org/).
 
+## [0.5.20] — 2026-11-06 — "copy-secret"
+
+### Ditambahkan
+- Tombol **salin** di samping **Webhook Secret** GOWA (sama seperti tombol salin Webhook URL), dengan umpan balik ikon centang.
+
 ## [0.5.19] — 2026-11-06 — "restart-notice"
 
 ### Ditambahkan
diff --git a/README.md b/README.md
index bfad427..5144fb8 100644
--- a/README.md
+++ b/README.md
@@ -11,7 +11,7 @@
 
 <p align="center">
   <img src="https://img.shields.io/badge/lisensi-ISC-ADFF2F" alt="Lisensi: ISC">
-  <img src="https://img.shields.io/badge/versi-0.5.19_restart--notice-ADFF2F" alt="Versi 0.5.19 (restart-notice)">
+  <img src="https://img.shields.io/badge/versi-0.5.20_copy--secret-ADFF2F" alt="Versi 0.5.20 (copy-secret)">
   <img src="https://img.shields.io/badge/Node.js-%E2%89%A520-339933" alt="Node.js >= 20">
   <img src="https://img.shields.io/badge/docker-ready-2496ED?logo=docker&logoColor=white" alt="Docker">
   <a href="https://demo-openisp.oxpoe.xyz"><img src="https://img.shields.io/badge/demo-live-ADFF2F?logo=googlechrome&logoColor=black" alt="Demo"></a>
diff --git a/package.json b/package.json
index e776816..b2bda33 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "open-isp",
-  "version": "0.5.19",
+  "version": "0.5.20",
   "description": "OPEN-ISP \u2014 sistem billing & manajemen ISP open-source (PWA pelanggan, multi-OLT, RADIUS, WhatsApp, QRIS)",
   "main": "app-customer.js",
   "scripts": {
diff --git a/version.txt b/version.txt
index aa49d36..3c7d01c 100644
--- a/version.txt
+++ b/version.txt
@@ -1 +1 @@
-0.5.19
\ No newline at end of file
+0.5.20
\ No newline at end of file
diff --git a/views/admin/whatsapp.ejs b/views/admin/whatsapp.ejs
index 8152c6a..fec2ea4 100644
--- a/views/admin/whatsapp.ejs
+++ b/views/admin/whatsapp.ejs
@@ -220,7 +220,10 @@
               </div>
               <div class="fg" style="flex:1;">
                 <label class="fl">Webhook Secret (HMAC)</label>
-                <input class="fc" name="gowa_webhook_secret" value="<%= gowaSettings.gowa_webhook_secret %>" placeholder="otomatis dibuat">
+                <div style="display:flex;gap:8px;">
+                  <input class="fc" id="gowa_webhook_secret" name="gowa_webhook_secret" value="<%= gowaSettings.gowa_webhook_secret %>" placeholder="otomatis dibuat">
+                  <button type="button" class="btn btn-g" onclick="copyGowaSecret(this)" title="Salin webhook secret"><i class="bi bi-copy"></i></button>
+                </div>
                 <div style="font-size:11px;color:var(--muted);margin-top:4px">Dibuat otomatis (32 byte). Samakan dengan <code>WHATSAPP_WEBHOOK_SECRET</code> di GOWA.</div>
               </div>
             </div>
@@ -347,6 +350,21 @@
         render();
         _gowaQrTick = setInterval(function () { remaining--; if (remaining < 0) remaining = 0; render(); }, 1000);
       }
+function copyGowaSecret(btn) {
+  var el = document.getElementById('gowa_webhook_secret');
+  if (!el) return;
+  var val = String(el.value || '');
+  try { el.select(); document.execCommand('copy'); } catch (e) {}
+  if (navigator.clipboard && window.isSecureContext) {
+    navigator.clipboard.writeText(val).catch(function () {});
+  }
+  if (btn) {
+    var old = btn.innerHTML;
+    btn.innerHTML = '<i class="bi bi-check2"></i>';
+    setTimeout(function () { btn.innerHTML = old; }, 1200);
+  }
+}
+
 function copyGowaWebhook() {
   var el = document.getElementById('gowa_webhook_url');
   if (!el) return;