diff --git a/__tests__/unit-tests/test-rest-api.php b/__tests__/unit-tests/test-rest-api.php
index c8bdc26..832bc9f 100644
--- a/__tests__/unit-tests/test-rest-api.php
+++ b/__tests__/unit-tests/test-rest-api.php
@@ -116,6 +116,17 @@ public function test_run_event() {
 		$this->assertArrayHasKey( 'message', $data );
 	}
 
+	public function test_array_secret_is_rejected() {
+		$request = new WP_REST_Request( 'POST', '/' . REST_API::API_NAMESPACE . '/' . REST_API::ENDPOINT_LIST );
+		$request->set_body( wp_json_encode( [ 'secret' => [] ] ) );
+		$request->set_header( 'content-type', 'application/json' );
+
+		$response = $this->server->dispatch( $request );
+
+		$this->assertResponseStatus( 400, $response );
+		$this->assertEquals( 'no-secret', $response->get_data()['code'] );
+	}
+
 	/**
 	 * Check response code
 	 *
diff --git a/includes/class-rest-api.php b/includes/class-rest-api.php
index ddf53c7..85c81fb 100644
--- a/includes/class-rest-api.php
+++ b/includes/class-rest-api.php
@@ -144,7 +144,7 @@ public function check_secret( $request ) {
 		$body = $request->get_json_params();
 
 		// For now, mimic original plugin's "authentication" method. This needs to be better.
-		if ( ! isset( $body['secret'] ) || ! hash_equals( \WP_CRON_CONTROL_SECRET, $body['secret'] ) ) {
+		if ( ! isset( $body['secret'] ) || ! is_string( \WP_CRON_CONTROL_SECRET ) || ! is_string( $body['secret'] ) || ! hash_equals( \WP_CRON_CONTROL_SECRET, $body['secret'] ) ) {
 			return new \WP_Error(
 				'no-secret',
 				__( 'Secret must be specified with all requests', 'automattic-cron-control' ),