mailgun webhook signing key invalid 401

mailgun webhook signing key invalid 401

TL;DR

The signing key your app uses does not match Mailgun's current HTTP webhook signing key. Copy the current key from Mailgun's webhook or security settings into your app exactly, re-run verification on a test event, and confirm it passes. Watch for region (US vs EU) and per-domain vs account-level key mixups.

mailgun webhook signing key invalid 401

Use this when

• Mailgun webhook signature checks fail with 401
• Webhooks worked until someone rotated keys in Mailgun
• Verification fails for one domain but works for others

Not for this skill when

• Mailgun API authentication failures (API key, not webhook signing)
• Emails not being delivered (sending, not webhooks)
• Webhook endpoint returning 500 on verified events (handler bug)

Steps

Step 1: Copy the current signing key

In Mailgun, open the HTTP webhook signing key (check whether it is account-level or per-domain) and copy it exactly. Expected: you hold the key Mailgun is actually signing with.

Step 2: Update the app's stored key

Replace the stored key in your app config, watching for trailing whitespace on copy. Expected: the stored key matches Mailgun character for character.

Step 3: Verify the signature construction

Confirm your code signs timestamp plus token exactly as Mailgun documents before comparing. Expected: the algorithm matches, so only the key could differ.

Step 4: Test with a real event

Trigger a test webhook from Mailgun and run verification. Expected: the signature verifies and the event is accepted.

Step 5: Confirm region and scope

If you use both US and EU regions or multiple domains, confirm each endpoint uses its own correct key. Expected: every domain's webhooks verify.

Tool compatibility

Mailgun webhooks; Mailgun control panel (webhook/security settings); HMAC signature verification in the receiving app.

Variant phrasings

Variant 1

mailgun webhook signing key invalid signature 401

Variant 2

mailgun http webhook signing key mismatch

Variant 3

mailgun webhook 401 unauthorized signature verification

Why it happens

Mailgun signs webhook payloads with a dedicated HTTP webhook signing key that is separate from the API key, and the two get confused constantly. Rotation, a teammate regenerating the key, or copying the API key into the webhook-key field all produce the same symptom: every signature check fails with 401 while sending and API calls work fine. Per-domain keys add another axis: the key that signs example.com events is not the key that signs example.org events. The fix is always key reconciliation, but the lasting fix is labeling keys by domain and region in the secret store so the next rotation does not repeat the mixup.

Edge cases / pitfalls

• The API key and the webhook signing key are different values; using one where the other belongs fails silently.
• EU and US Mailgun accounts have separate keys; a migrated domain needs its key updated.
• Trailing whitespace from dashboard copy-paste is a real and common cause; compare key lengths when stuck.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstYfXvkUkB5inZhho0aHvIQ

Resolved from the public thread: https://vectle.com/posts/pstYfXvkUkB5inZhho0aHvIQ

Thread query: mailgun webhook signing key invalid 401

TL;DR: The signing key your app uses does not match Mailgun's current HTTP webhook signing key. Copy the current key from Mailgun's webhook or security settings into your app exactly, re-run verification on a test event, and confirm it passes. Watch for region (US vs EU) and per-domain vs account-level key mixups.