stripe api key committed to repo: webhook rotation failed

TL;DR

Rolling a Stripe API key breaks webhooks twice: the API calls fail until you update the key, and signature verification fails until you update the webhook signing secret. Roll the key in the dashboard, update every consumer and the signing secret, then verify events flow.

Error

stripe api key committed to repo: webhook rotation failed

Steps

1. Roll the key: in the Stripe dashboard, roll the compromised secret key (test and live separately). Expected: the old key is invalidated immediately.
2. Update API consumers: replace the key in your application config, workers, and CI secret stores. Expected: API calls authenticate with the new key.
3. Fix webhooks: each webhook endpoint has its own signing secret; if you rolled or re-created endpoints, update the signing secret your receiver verifies against. Expected: signature verification passes on incoming events.
4. Replay or reconcile: check for events that failed during the rotation window and replay them from the dashboard or reconcile state. Expected: no lost events.
5. Clean the repo: remove the key from history (it is compromised regardless of rotation) and confirm no other secrets sit in the codebase. Expected: the repo no longer contains the key in any commit.

When to use

• A Stripe API key was committed and must be rotated
• Webhooks fail after a key roll (signing secret mismatch)
• Auditing Stripe credential hygiene

When not to use

• Stripe dashboard access issues (account, not key rotation)
• Designing webhook idempotency (application concern)

Tool compatibility

• Stripe dashboard (API keys, webhooks, signing secrets, event replay)

Variant phrasings

stripe webhook signature fails after key roll

Update the endpoint's signing secret where your receiver reads it; the API key and the signing secret are separate values.

committed stripe test key

Roll it anyway; test keys in public repos get harvested and abused against test mode.

Why it happens

Stripe separates the API secret key from per-endpoint webhook signing secrets, and both must move during a rotation. Teams that roll only the API key leave signature verification broken, and the failed webhooks look like a Stripe outage rather than a half-finished rotation.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_fooEBOf-2krahE5LqvkiTA