intercom webhook delivery failed 401

Fix Intercom webhook delivery failing with 401

TL;DR

Intercom webhook 401s mean your endpoint rejects its requests, usually a missing or wrong auth check on your side. Confirm what your endpoint expects and make sure Intercom's requests satisfy it, or exempt the webhook path from auth and verify the payload signature instead.

The error

Intercom webhook delivery failed
HTTP 401 Unauthorized from webhook endpoint

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=intercom webhook delivery failed 401"

Fix it

Step 1: Check what auth your endpoint requires

Look at the middleware on the webhook route: API key, basic auth, or IP checks.

Expected: You know exactly which check is rejecting Intercom.

Step 2: Decide: satisfy it or exempt the path

Either give Intercom the credential it needs, or exempt the webhook path and verify the Intercom signature header instead.

Expected: The route has one clear auth story.

Step 3: Verify Intercom's signature if you exempt

Validate the payload signature using your Intercom webhook secret.

Expected: Genuine Intercom events pass; forged ones are rejected.

Step 4: Trigger a test delivery

Send a test webhook from the Intercom app store settings.

Expected: Delivery returns 200.

Step 5: Watch the delivery log

Check Intercom's webhook delivery log for the endpoint.

Expected: Deliveries show success with no new 401s.

When this applies

• Intercom webhooks fail with 401
• Webhooks worked and broke after adding auth middleware
• You are securing a new webhook endpoint

When it doesn't

• The endpoint 404s (check the URL)
• The endpoint 500s (check your handler)
• Intercom never sends (check the subscription topics)

Compatibility

Intercom webhooks (app store webhooks). Any stack.

Variant phrasings

intercom webhook unauthorized 401

Same failure. The 401 comes from your endpoint, not from Intercom's side.

intercom webhook auth failed

If you verify signatures, a wrong secret looks like an auth failure. Check the secret value.

intercom delivery failing after deploy

Deploys that add global auth middleware are the classic regression for webhook paths.

Why it happens

Intercom delivers plain HTTPS POSTs with a signature header; it does not know your endpoint's auth scheme. When your endpoint demands a credential Intercom was never given, every delivery 401s. The fix is to align the two sides: either provision the credential or verify signatures instead.

Edge cases

• Basic-auth credentials in the webhook URL work but leak in logs; prefer signature verification
• IP allow-listing is brittle as Intercom's egress IPs change; signatures are the stable check
• A 401 on the challenge or verification request blocks setup entirely; test that path too

If it still fails

• Reproduce with a test event from the provider dashboard to separate delivery problems from handler bugs.
• Log the raw payload shape, never customer PII, so the next failure is comparable.
• Check the provider status page; delivery outages mimic endpoint bugs.
• Replay a known-good event after the fix to prove the path works, not just that errors stopped.
• If signature failures persist with correct code, rotate the signing secret once; stale secrets cause silent mismatches.

Prevention

• Return 200 fast and process async on every new webhook receiver.
• Make event handling idempotent from day one; retries are guaranteed.
• Monitor delivery success rates, not just endpoint uptime.
• Keep signing secrets per endpoint and rotate them on a schedule.
• Reconcile critical events against the provider API, not just webhooks.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_xRq4pODkrJTGJ6hwjuRajg

Resolved from the public thread: https://vectle.com/posts/pst_xRq4pODkrJTGJ6hwjuRajg

Thread query: intercom webhook delivery failed 401

TL;DR: Intercom webhook 401s mean your endpoint rejects its requests, usually a missing or wrong auth check on your side. Confirm what your endpoint expects and make sure Intercom's requests satisfy it, or exempt the webhook path from auth and verify the payload signature instead.