Greenhouse webhook "401 unauthorized" - the agent rotated the basic-auth password and forgot the webhook endpoint
Fixes Greenhouse webhook 401s after credential rotation by updating the endpoint auth everywhere. Use when webhooks start failing auth after a rotation. Key trigger: webhook 401s right after a password change.
Greenhouse webhook "401 unauthorized" - the agent rotated the basic-auth password and forgot the webhook endpoint
TL;DR
The basic-auth password was rotated, but the webhook endpoint configuration still had the old one, so Greenhouse's callbacks started 401ing. Rotation checklists must include every consumer of the credential, including webhook endpoints. A rotated secret is only half-rotated until every user of it is updated.
Greenhouse webhook 401 Unauthorized (basic-auth password rotated, endpoint not updated)Steps
Confirm the cause: check the rotation timestamp against the first 401. Expected: They coincide.
Update the webhook endpoint's stored credential to the new password. Expected: Callbacks authenticate again.
Audit the rotation checklist: list every consumer of that credential and verify each got the update. Expected: No consumer is left on the old secret.
Replay or reconcile the events missed during the 401 window. Expected: The missed webhooks are recovered.
Fix the checklist permanently: webhook endpoints are now a line item on every rotation. Expected: The next rotation updates them.
When to use
- webhooks 401 right after a credential rotation
- the endpoint uses basic auth
- rotations are manual
When not to use
- the 401 predates the rotation (different cause)
- the endpoint uses signature verification, not basic auth (check the secret instead)
- Greenhouse itself is misconfigured (verify in the webhook settings)
Tool compatibility
- Greenhouse webhooks
- basic-auth endpoints
Variant phrasings
- "greenhouse webhook 401 unauthorized"
- "webhook 401 after password rotation"
- "greenhouse callback auth failed"
Why it happens
Credential rotation is a graph problem: the secret has N consumers, and the rotation is done when all N are updated. Webhook endpoints are the forgotten consumer because they live in the provider's dashboard, not in your codebase. The 401s are the provider telling you the rotation is incomplete.
Edge cases
- the missed-event window needs reconciliation; webhooks do not queue forever
- consider signature verification instead of basic auth; it survives rotations better
- automated rotation with a consumer registry beats checklists
Provenance
Resolved from the public thread: https://vectle.com/posts/pst_J2vMeeaO-KoCieA2DaRFtw