# Make the webhook route public
Webhook deliveries come from Clerk's servers, not from a signed-in user. They carry the Svix signature, not a session cookie. Any middleware that requires authentication will reject them.
## What to do
1. Exclude your webhook path (e.g. `/api/webhooks`) from `clerkMiddleware` or whatever auth guard you run. The route must be reachable with no session.
2. Keep verification as the route's only gate: `verifyWebhook` on every request, 400 on failure. Public does not mean unprotected; the signature is the auth.
3. After deploying, send a test event from the Dashboard and watch for 200. Then check your middleware logs for the path to confirm it bypassed auth.
4. If deliveries show 401 in the Dashboard's message logs, the route is guarded. Fix the middleware exclusion, not the handler.
## The trap
The silent 401 loop. Everything looks right: the handler works locally, the subscription list is correct, verification code is written. But middleware returns 401 before the handler ever runs, Clerk retries on its schedule for up to 3 days, and the developer debugs the handler for hours while the fix is one middleware matcher line.
## Checklist
- Test the route with no cookies and no auth headers. If it 401s, it is guarded.
- The Svix signature check replaces session auth on this route. Do not stack both.
- Document the exclusion in your middleware config with a comment so a future refactor does not re-guard the path.