sift api key rotated and chargeback webhooks stopped arriving

TL;DR

Sift webhooks do not use your Score API key directly, but rotations often change the shared configuration around them: the endpoint credentials, the signing verification on your side, or an IP allowlist, and delivery stops at exactly rotation time. Compare the last successful delivery timestamp with the rotation time, verify your endpoint still accepts and correctly verifies current webhook signatures, and re-save the webhook configuration in the console to force a clean registration. Then replay or manually reconcile the chargeback and decision events missed in the gap.

sift api key rotated and chargeback webhooks stopped arriving

Use this when

• Webhook deliveries stop at the same hour as a key rotation.
• Chargeback labels stopped flowing back into Sift or into your warehouse.
• Your endpoint logs show rejected signatures right after the rotation.

Not for this skill when

• Deliveries are attempted and your server returns 500. Fix your endpoint, not the rotation.
• Only one webhook type stopped while others flow. That points at that subscription, not credentials.

Steps

1. Establish the gap: find the last successful webhook delivery time in the console and in your server logs and line it up with the rotation record. Verify: both sources agree on when delivery stopped.
2. Verify your endpoint verification logic against a fresh test webhook from the console, using the current webhook credentials configured there. Verify: the test webhook verifies and returns a 200 from your endpoint.
3. Re-save the webhook endpoint configuration in the Sift console, even if nothing looks changed, to clear stale registration state. Verify: the console shows the endpoint active with a current updated time.
4. Trigger a real low risk event and confirm end to end delivery resumes. Verify: a new delivery appears in both the console log and your server log.
5. Reconcile the gap window: pull decisions and chargeback outcomes for that period from the console or API and load them into the places webhooks normally feed. Verify: the gap period has no missing chargeback labels in your records.

Variant phrasings

sift webhooks stopped after key change

Rotation phrasing.

chargeback webhooks not arriving sift

Chargeback focused phrasing.

sift webhook signature failing after rotation

Signature phrasing.

Compatibility: Sift webhooks for decisions, scores, and chargeback feedback. Verification details follow the Sift webhook documentation for your integration, so test with the console sender rather than a hand built request.

Why it happens

Key rotation is rarely one change. It ships with config edits, secret store updates, and sometimes an endpoint URL or allowlist change, and webhook verification on the receiving side often reads a credential that rotation invalidated. Delivery then fails verification and, after retries exhaust, the gap looks like Sift simply went quiet.

Edge cases / pitfalls

• Rotation runbooks should list webhooks explicitly. They are the integration everyone forgets because they are inbound, not outbound.
• Keep the old and new credentials both accepted during a short overlap window when the platform supports it, then remove the old one.
• A silent webhook gap corrupts training labels. Flag the gap dates in your label data so the model team knows those weeks are thin.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Ok5TlZfJA1-h5Z9zYc5COg