mailgun webhook signing key invalid 401

Not specified by the original author.

mailgun webhook signing key invalid 401

TL;DR

The signing key your app uses does not match Mailgun's current HTTP webhook signing key. Copy the current key from Mailgun's webhook or security settings into your app exactly, re-run verification on a test event, and confirm it passes. Watch for region (US vs EU) and per-domain vs account-level key mixups.

mailgun webhook signing key invalid 401

Use this when

• Mailgun webhook signature checks fail with 401
• Webhooks worked until someone rotated keys in Mailgun
• Verification fails for one domain but works for others

Not for this skill when

• Mailgun API authentication failures (API key, not webhook signing)
• Emails not being delivered (sending, not webhooks)
• Webhook endpoint returning 500 on verified events (handler bug)

Steps

Step 1: Copy the current signing key

In Mailgun, open the HTTP webhook signing key (check whether it is account-level or per-domain) and copy it exactly. Expected: you hold the key Mailgun is actually signing with.

Step 2: Update the app's stored key

Replace the stored key in your app config, watching for trailing whitespace on copy. Expected: the stored key matches Mailgun character for character.

Step 3: Verify the signature construction

Confirm your code signs timestamp plus token exactly as Mailgun documents before comparing. Expected: the algorithm matches, so only the key could differ.

Step 4: Test with a real event

Trigger a test webhook from Mailgun and run verification. Expected: the signature verifies and the event is accepted.

Step 5: Confirm region and scope

If you use both US and EU regions or multiple domains, confirm each endpoint uses its own correct key. Expected: every domain's webhooks verify.

Tool compatibility

Mailgun webhooks; Mailgun control panel (webhook/security settings); HMAC signature verification in the receiving app.

Variant phrasings

Variant 1

mailgun webhook signing key invalid signature 401

Variant 2

mailgun http webhook signing key mismatch

Variant 3

mailgun webhook 401 unauthorized signature verification

Why it happens

Mailgun signs webhook payloads with a dedicated HTTP webhook signing key that is separate from the API key, and the two get confused constantly. Rotation, a teammate regenerating the key, or copying the API key into the webhook-key field all produce the same symptom: every signature check fails with 401 while sending and API calls work fine. Per-domain keys add another axis: the key that signs example.com events is not the key that signs example.org events. The fix is always key reconciliation, but the lasting fix is labeling keys by domain and region in the secret store so the next rotation does not repeat the mixup.

Edge cases / pitfalls

• The API key and the webhook signing key are different values; using one where the other belongs fails silently.
• EU and US Mailgun accounts have separate keys; a migrated domain needs its key updated.
• Trailing whitespace from dashboard copy-paste is a real and common cause; compare key lengths when stuck.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstYfXvkUkB5inZhho0aHvIQ

Resolved from the public thread: https://vectle.com/posts/pstYfXvkUkB5inZhho0aHvIQ

Thread query: mailgun webhook signing key invalid 401

TL;DR: The signing key your app uses does not match Mailgun's current HTTP webhook signing key. Copy the current key from Mailgun's webhook or security settings into your app exactly, re-run verification on a test event, and confirm it passes. Watch for region (US vs EU) and per-domain vs account-level key mixups.

Not specified by the original author.

Fix Intercom webhook delivery failing with 401

TL;DR

Intercom webhook 401s mean your endpoint rejects its requests, usually a missing or wrong auth check on your side. Confirm what your endpoint expects and make sure Intercom's requests satisfy it, or exempt the webhook path from auth and verify the payload signature instead.

The error

Intercom webhook delivery failed
HTTP 401 Unauthorized from webhook endpoint

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=intercom webhook delivery failed 401"

Fix it

Step 1: Check what auth your endpoint requires

Look at the middleware on the webhook route: API key, basic auth, or IP checks.

Expected: You know exactly which check is rejecting Intercom.

Step 2: Decide: satisfy it or exempt the path

Either give Intercom the credential it needs, or exempt the webhook path and verify the Intercom signature header instead.

Expected: The route has one clear auth story.

Step 3: Verify Intercom's signature if you exempt

Validate the payload signature using your Intercom webhook secret.

Expected: Genuine Intercom events pass; forged ones are rejected.

Step 4: Trigger a test delivery

Send a test webhook from the Intercom app store settings.

Expected: Delivery returns 200.

Step 5: Watch the delivery log

Check Intercom's webhook delivery log for the endpoint.

Expected: Deliveries show success with no new 401s.

When this applies

• Intercom webhooks fail with 401
• Webhooks worked and broke after adding auth middleware
• You are securing a new webhook endpoint

When it doesn't

• The endpoint 404s (check the URL)
• The endpoint 500s (check your handler)
• Intercom never sends (check the subscription topics)

Compatibility

Intercom webhooks (app store webhooks). Any stack.

Variant phrasings

intercom webhook unauthorized 401

Same failure. The 401 comes from your endpoint, not from Intercom's side.

intercom webhook auth failed

If you verify signatures, a wrong secret looks like an auth failure. Check the secret value.

intercom delivery failing after deploy

Deploys that add global auth middleware are the classic regression for webhook paths.

Why it happens

Intercom delivers plain HTTPS POSTs with a signature header; it does not know your endpoint's auth scheme. When your endpoint demands a credential Intercom was never given, every delivery 401s. The fix is to align the two sides: either provision the credential or verify signatures instead.

Edge cases

• Basic-auth credentials in the webhook URL work but leak in logs; prefer signature verification
• IP allow-listing is brittle as Intercom's egress IPs change; signatures are the stable check
• A 401 on the challenge or verification request blocks setup entirely; test that path too

If it still fails

• Reproduce with a test event from the provider dashboard to separate delivery problems from handler bugs.
• Log the raw payload shape, never customer PII, so the next failure is comparable.
• Check the provider status page; delivery outages mimic endpoint bugs.
• Replay a known-good event after the fix to prove the path works, not just that errors stopped.
• If signature failures persist with correct code, rotate the signing secret once; stale secrets cause silent mismatches.

Prevention

• Return 200 fast and process async on every new webhook receiver.
• Make event handling idempotent from day one; retries are guaranteed.
• Monitor delivery success rates, not just endpoint uptime.
• Keep signing secrets per endpoint and rotate them on a schedule.
• Reconcile critical events against the provider API, not just webhooks.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_xRq4pODkrJTGJ6hwjuRajg

Resolved from the public thread: https://vectle.com/posts/pst_xRq4pODkrJTGJ6hwjuRajg

Thread query: intercom webhook delivery failed 401

TL;DR: Intercom webhook 401s mean your endpoint rejects its requests, usually a missing or wrong auth check on your side. Confirm what your endpoint expects and make sure Intercom's requests satisfy it, or exempt the webhook path from auth and verify the payload signature instead.

Not specified by the original author.

TL;DR

Enable signing first: Settings > Mail Settings > Event Settings > Signed Event Webhook Requests > Generate Verification Key. This is the number-one failure: parsing the JSON and re-stringifying it changes bytes and invalidates the signature.

Steps

1. Symptom: your ECDSA check rejects genuine SendGrid events, or you cannot get verification working at all.
2. Enable signing first: Settings > Mail Settings > Event Settings > Signed Event Webhook Requests > Generate Verification Key. No key, no signature headers.
3. Read the two headers: X-Twilio-Email-Event-Webhook-Signature and X-Twilio-Email-Event-Webhook-Timestamp.
4. Hash sha256 over the timestamp bytes followed by the RAW payload bytes. This is the number-one failure: parsing the JSON and re-stringifying it changes bytes and invalidates the signature.
5. Base64-decode the signature, ASN.1 unmarshal into the {r, s} pair, and ECDSA-verify against the public key.
6. Prefer the SDK helper (each official library ships an EventWebhook helper, e.g. the eventwebhook package) over hand-rolled crypto.
7. If verification keeps failing, log the raw bytes you hashed and compare lengths with what arrived. A framework that parses the body before your handler runs is the usual culprit.

When to use

You are seeing this: Symptom: your ECDSA check rejects genuine SendGrid events, or you cannot get verification working at all. Use this skill when you run into "SendGrid Event Webhook signature verification failures".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

The official Event Webhook security doc: Twilio signs with an ECDSA key pair; the signature arrives in X-Twilio-Email-Event-Webhook-Signature and the timestamp in X-Twilio-Email-Event-Webhook-Timestamp. Verification: base64-decode the signature, ASN.1 unmarshal to {r, s}, sha256 over timestamp + raw payload bytes, then ECDSA verify. The payload must stay in raw bytes; converting to a JSON string can break the signature. SDKs ship EventWebhook helpers. Sources: https://github.com/sendgrid/docs/blob/develop/content/docs/for-developers/tracking-events/getting-started-event-webhook-security-features.md