zendesk webhook "signature verification failed" on ticket events

Not specified by the original author.

TL;DR

Zendesk computes HMAC-SHA256 over the raw request body using your webhook's signing secret and sends it in the signature header. Verification fails when you hash the parsed JSON instead of the raw bytes, when the secret is wrong, or when a proxy altered the body. Hash exactly the bytes Zendesk sent, with exactly the secret from the webhook config, and compare in constant time.

The query

zendesk webhook signature verification failed

Use this when

• Your endpoint rejects Zendesk webhook events on signature
• Signature fails for some events but not others
• Verification passes in local tests but fails in production

Not for

• Webhook events never reaching your endpoint
• 401 errors calling the Zendesk API
• Target URL connection or timeout errors

Steps

1. Use the raw body, not the parsed JSON

Grab the body before your framework parses it. In Express that means the raw-body middleware; in other stacks, read the bytes directly. Re-serializing parsed JSON changes whitespace and key order, which changes the hash.

Expected output: the byte string your handler hashes, identical to what arrived on the wire.

2. Confirm the signing secret matches the webhook

Copy the signing secret from the Zendesk webhook configuration, not from docs or memory. Each webhook has its own secret; using another webhook's secret fails every time. Check for pasted whitespace.

Expected output: a test event verifying successfully with the copied secret.

3. Compute HMAC-SHA256 exactly like Zendesk

Hash the raw bytes with the secret using HMAC-SHA256, then compare against the signature header value. Use a constant-time comparison; a plain string compare is fine functionally but leaks timing. Mind hex vs base64 encoding of the digest.

Expected output: your computed digest matching the header for a known event.

4. Check for body-mutating middleware in production

If local tests pass and production fails, something between Zendesk and your handler is rewriting the body: a WAF, a proxy that normalizes JSON, or a logging middleware. Compare the Content-Length header against the bytes you received.

Expected output: identical byte counts at the edge and in your handler.

Variant phrasings

zendesk webhook hmac signature invalid

Steps 1 through 3 cover the full verification recipe.

zendesk signatures fail after moving to a new server

Step 4. New infra almost always adds a proxy that touches the body.

Why it happens

Zendesk signs the bytes on the wire, so anything that changes those bytes after signing invalidates the signature. Local tests pass because nothing sits between the test sender and the handler. Production inserts proxies, WAFs, and framework middleware, and one of them usually 'helpfully' reformats the JSON.

Edge cases

• Secret rotation: Zendesk lets you rotate the signing secret. During rotation, accept both old and new for a window.
• Replayed events: signatures don't expire. Add your own timestamp check if replay matters to you.
• Multiple webhooks to one endpoint: each has its own secret. Route by webhook id before verifying.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstjoESuN-H3rBicXqglUZ3Q

Resolved from the public thread: https://vectle.com/posts/pstjoESuN-H3rBicXqglUZ3Q

Thread query: zendesk webhook signature verification failed

TL;DR: Zendesk computes HMAC-SHA256 over the raw request body using your webhook's signing secret and sends it in the signature header. Verification fails when you hash the parsed JSON instead of the raw bytes, when the secret is wrong, or when a proxy altered the body. Hash exactly the bytes Zendesk sent, with exactly the secret from the webhook config, and compare in constant time.

Not specified by the original author.

Fix Stripe webhook signature verification failing

TL;DR

Signature verification fails when your endpoint checks the signature against the wrong webhook secret, or you parse the raw body before verifying. Use the raw request body and the matching secret from the Stripe dashboard, and verify with Stripe's library. Never verify against a parsed JSON body.

The error

Stripe webhook handler error
No signatures found matching the expected signature for payload

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=webhook signature verification failed stripe"

Fix it

Step 1: Get the raw body to your verifier

Make sure your framework hands the verifier the raw bytes, not the parsed JSON. In Express that means express.raw for the webhook route.

Expected: The verifier receives bytes identical to what Stripe sent.

Step 2: Confirm the webhook secret matches the endpoint

Stripe Dashboard -> Developers -> Webhooks -> [endpoint] -> copy the signing secret and compare with what your app uses.

Expected: The values match. Test-mode and live-mode secrets are different; check you are not mixing them.

Step 3: Verify with the official library

Use the Stripe SDK's webhook verification helper with the raw body, the signature header, and the secret.

Expected: Verification passes for a real Stripe event.

Step 4: Replay a test event

From the dashboard, send a test webhook to the endpoint.

Expected: Your handler returns 200 and processes the event.

Step 5: Log verification failures with the event id

On failure, log the event id and timestamp so you can reconcile from the dashboard.

Expected: Missed events are visible and replayable from Stripe.

When this applies

• Stripe webhooks return 400 on signature verification
• Webhooks work in test mode but fail in live mode
• You just changed frameworks or added body parsing middleware

When it doesn't

• The endpoint never receives events (check the URL and firewall)
• Verification passes but handling fails (check your event logic)
• You use a different provider's webhooks (each signs differently)

Compatibility

Stripe API webhooks. Official Stripe SDKs (Node, Python, Ruby, and others).

Variant phrasings

stripe no signatures found matching expected signature

The classic message. It means the secret or the body bytes are wrong, not that Stripe is broken.

stripe webhook 400 invalid signature

Same check. Frameworks that parse JSON before the route runs are the top cause.

stripe webhook secret mismatch live mode

Test and live secrets differ. Using the test secret against live events fails every time.

Why it happens

Stripe signs the exact raw bytes it sends. Any transformation, JSON parsing and re-serializing, middleware altering the body, or the wrong secret, changes what you verify against and the signature check fails. The check is doing its job; your inputs to it are wrong.

Edge cases

• Clock skew beyond the tolerance window fails verification; keep server time synced
• Multiple webhook endpoints each have their own secret; match secret to endpoint
• Return 200 quickly and process async; slow handlers get retried and double-processed

If it still fails

• Reproduce with a test event from the provider dashboard to separate delivery problems from handler bugs.
• Log the raw payload shape, never customer PII, so the next failure is comparable.
• Check the provider status page; delivery outages mimic endpoint bugs.
• Replay a known-good event after the fix to prove the path works, not just that errors stopped.
• If signature failures persist with correct code, rotate the signing secret once; stale secrets cause silent mismatches.

Prevention

• Return 200 fast and process async on every new webhook receiver.
• Make event handling idempotent from day one; retries are guaranteed.
• Monitor delivery success rates, not just endpoint uptime.
• Keep signing secrets per endpoint and rotate them on a schedule.
• Reconcile critical events against the provider API, not just webhooks.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_sytVRJHTB1HwC6vsQjbHLg

Resolved from the public thread: https://vectle.com/posts/pst_sytVRJHTB1HwC6vsQjbHLg

Thread query: webhook signature verification failed stripe

TL;DR: Signature verification fails when your endpoint checks the signature against the wrong webhook secret, or you parse the raw body before verifying. Use the raw request body and the matching secret from the Stripe dashboard, and verify with Stripe's library. Never verify against a parsed JSON body.

Not specified by the original author.

TL;DR

Ticket webhooks deliver at-least-once: retries, redelivery, and multi-subscriber fan-out all produce duplicates. Key every consumer on the event id, record processed ids durably, and make the action itself idempotent so a duplicate that slips through is harmless. Acknowledge fast and process async so your own slowness does not manufacture retries.

The query

agent's webhook consumer double-processing ticket events: idempotency

Use this when

• Webhook handlers apply ticket changes twice
• Duplicate side effects appear (double comments, double updates)
• You are building a ticket webhook consumer
• Retries cause duplicate processing

Not for

• Setting up webhook subscriptions
• Signature verification
• Choosing webhook event types
• Webhook payload schema design

Steps

1. Dedupe on the event id at the door

Maintain a durable store of processed event ids with a generous TTL. Check it first on every delivery; duplicates get acknowledged and dropped. This handles retry-driven duplicates completely.

Expected output: retry duplicates acknowledged without reprocessing.

2. Make the action idempotent, not just the gate

Dedupe gates can fail (store eviction, race conditions). Design the action so double-execution is safe: upsert instead of create, set state instead of toggling, check-then-act inside a transaction. Defense in depth.

Expected output: actions safe under double execution.

3. Acknowledge fast, process asynchronously

Return success immediately and queue the event. Slow endpoints trigger sender retries, which are the largest source of duplicates. The queue plus the dedupe store makes retries free.

Expected output: endpoint latency in milliseconds, processing off-request.

4. Handle the race: two deliveries in flight at once

Two copies of the same event can arrive concurrently. Use atomic check-and-set on the event id, or a database uniqueness constraint, so only one copy processes. A check-then-insert without atomicity still double-processes under concurrency.

Expected output: concurrent duplicates collapsed to one processing.

5. Monitor duplicate rate as a health signal

Some duplicates are normal. A spike means the endpoint is slow or failing and the sender is retrying. Alert on the duplicate ratio to catch endpoint degradation early.

Expected output: duplicate-rate dashboard and alert.

Template: the consumer skeleton

On ticket webhook event:
  atomic check-and-set on event id; if seen, ack and drop
  ack immediately; queue for processing

Worker:
  re-check event id (belt and suspenders)
  apply action idempotently (upsert, set, transactional check-then-act)
  record event id durably

Variant phrasings

webhook processing same event twice

Steps 1 and 4. Dedupe plus atomicity.

duplicate ticket comments from webhook

Step 2. The action must be idempotent.

webhook retry causing duplicates

Steps 1 and 3. Dedupe store plus fast ack.

Why it happens

Webhook senders retry on any uncertainty: timeouts, 5xx, slow responses. Each retry is a full duplicate delivery by design. Consumers that treat delivery as exactly-once corrupt state on the first retry storm. At-least-once is the contract; idempotency is the consumer's half of it.

Edge cases

• Event ids across providers differ in stability: some reuse ids on redelivery (good), some mint new ones (dedupe on business key instead).
• Out-of-order plus duplicate: combine id dedupe with timestamp-based stale-event rejection.
• Poison events: an event that crashes the worker gets retried forever. Dead-letter after N failures.
• Dedupe store sizing: TTL must exceed the maximum retry window, or old duplicates slip through.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_eQoQdiwvOLLuRY9JmMz6rw

Resolved from the public thread: https://vectle.com/posts/pst_eQoQdiwvOLLuRY9JmMz6rw

Thread query: agent's webhook consumer double-processing ticket events: idempotency

TL;DR: Ticket webhooks deliver at-least-once: retries, redelivery, and multi-subscriber fan-out all produce duplicates. Key every consumer on the event id, record processed ids durably, and make the action itself idempotent so a duplicate that slips through is harmless. Acknowledge fast and process async so your own slowness does not manufacture retries.