agent cached the stripe webhook signing secret value verification broke after rotation
Fixes Stripe webhook verification failures from a cached signing secret. Use when signature checks start failing after a secret roll, because the agent kept using the old value. Not for endpoint misconfiguration or payload parsing errors.
agent cached the stripe webhook signing secret value verification broke after rotation
TL;DR
Your agent cached the old webhook signing secret and kept verifying against it after you rolled to a new one. Fetch the current secret (Stripe supports multiple active secrets during a roll), verify against each active secret, and stop caching the value indefinitely. Cache with a short TTL or read it fresh per deployment.
agent cached the stripe webhook signing secret value verification broke after rotationSteps
- Confirm the roll: compare the secret your agent uses against the current secrets in the Stripe dashboard. Success check: you can see the old cached value and the new live value.
- Update the agent to read all currently active signing secrets, not just one. Success check: verification tries each active secret until one matches.
- Clear the stale cache everywhere the agent runs, including background workers. Success check: no process still holds the old secret.
- Re-fetch or replay webhooks rejected during the gap. Success check: missed events are processed in order.
- Replace the indefinite cache with a short TTL or a deploy-time read, and alert when verification failures spike. Success check: the next roll needs no manual cache clear.
When this applies
- Stripe webhook signature verification fails after a signing secret roll.
- An agent cached the secret and never refreshed it.
- Some workers verify fine while others fail (stale per-process cache).
When it doesn't
- Webhooks never arriving; check the endpoint configuration.
- Signature code that never worked; test against a known-good event first.
- API key issues; webhook signing secrets are separate credentials.
Tool + version compatibility
Stripe webhooks and signature verification in all current SDKs.
"stripe webhook signature failed after secret roll"
Read all active secrets and clear the stale cache.
"stripe signing secret cached verification failed"
Short TTL or deploy-time read; indefinite caching breaks on every roll.
"stripe webhook endpoint secret rotated"
Support multiple active secrets during the roll window.
Why it happens
Stripe lets you roll webhook signing secrets with an overlap: the old and new secrets are both valid for a time. That only helps if your code knows about both. An agent that fetched the secret once at startup and cached it forever verifies new signatures against the old secret and fails everything after the roll. The cache, not the rotation, is the bug.
Edge cases / pitfalls
- Rolling the secret again does not fix a stale cache; the cache is the problem.
- Background workers and edge functions often have their own caches; clear all of them.
- Verify against the raw request body; parsed-and-reserialized bodies never match signatures.
- Keep a counter on verification failures; a spike is the earliest signal of the next stale cache.
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_X4S3qHGeLacEZ3YJ4rS2fw