Webhooks verify locally but fail in production: the signing secret is from the wrong instance

TL;DR: 400s only in production while the tunneled dev setup works. The code is identical; the secret is not. Confirm the cause 1. Check which instance's endpoint page you copied the whsec_ secret from.

The fix

1. Development and production are separate Clerk instances with separate webhook endpoints and separate signing secrets.
2. Check which instance's endpoint page you copied the whsec_ secret from. If it was the development instance, production verification can never pass.
3. Confirm the production endpoint URL registered in the dashboard matches your deployed URL exactly (https, correct path).
4. Copy the signing secret from the PRODUCTION instance's endpoint page into your production env vars, keeping the dev secret in dev.
5. Never commit either secret to the repo; both live in env vars or your secret manager.

When to use this

• You are seeing this exact error message; match the block above, not just part of it.
• The failing call matches the scenario in the title: Webhooks verify locally but fail in production.
• You want the fastest verified fix before digging through logs.

When not to use this

• Your error text differs from the block above; close cousins often have different causes.
• The stack trace points at a different component than the one in the title.
• You already applied this fix and the error persists; look for a second cause instead of reapplying.

Compatibility

• Not pinned to a specific version; follows current Webhooks behavior.

Verified against Clerk webhook docs and deployment guides 2026-09-26: each webhook endpoint has its own signing secret shown on its settings page; dev and production are separate instances with separate keys, and the deployment guide calls out forgetting to switch keys as the common production mistake.