Delighted webhook signature verification fails after API secret rotation

TL;DR

Fix this in Delighted webhook verification by acting on the exact problem first: update the webhook receiver to use the new signing credential Delighted issued at rotation, accept both old and new signatures during a short overlap if the receiver supports it, and replay the deliveries that failed verification once the receiver passes a test event.. Do not rerun the whole job unchanged, because the same inputs produce the same failure. Prove the fix on one response, batch or record set first, then rerun the full scope and reconcile the counts.

Delighted webhook signature verification fails after API secret rotation

Use this when

• The operation in Delighted webhook verification fails with this exact problem or symptom: Delighted webhook signature verification fails after API secret rotation.
• The same failure repeats on retry with unchanged inputs.
• NPS follow-up, routing or reporting is blocked until this item completes.

Not for this skill when

• The message is an outage notice from the platform. Resolve that first, then return here if this problem remains.
• The operation completes and you only disagree with its output quality. That is a quality review, not this failure.

Steps

1. Reproduce the failure with the smallest scope that still shows it in Delighted webhook verification, and copy the full problem plus the response, contact or job involved into the run notes. Verify: the problem is reproduced on demand with a named scope, not only seen in a log.
2. Apply the specific fix for this problem: update the webhook receiver to use the new signing credential Delighted issued at rotation, accept both old and new signatures during a short overlap if the receiver supports it, and replay the deliveries that failed verification once the receiver passes a test event.. Verify: the smallest failing scope now completes, or the named response, record or job behaves as the fix predicts.
3. Check the neighbouring responses, records or jobs that share the same config, segment or credential, because this class of failure rarely affects only one item. Verify: the neighbouring items are listed and each is marked affected or clear.
4. Rerun the original operation in Delighted webhook verification on the previously failing scope, watching for the same problem rather than assuming success from a quiet log. Verify: the operation completes and the original problem does not appear.
5. Compare the result counts or status against the source in Delighted webhook verification so a silent partial success is caught before sign off. Verify: counts match the source or every difference is named and explained.
6. Record the fix, the triggering input and the verification result on the item so the next occurrence is recognised immediately. Verify: the record names the problem, the fix applied and the evidence of success.

Why it happens

Rotation changed the signing value on the Delighted side while the receiver still checked against the previous value, so genuine deliveries failed verification and were rejected.

Variant phrasings

Delighted webhook signature verification fails after API secret rotation

The verbatim form searchers paste from the console or report. Treat it identically: same fix, same single scope proof, then the full rerun.

How to fix - Delighted webhook signature verification fails after API secret rotation

The how-to phrasing for the same failure in Delighted webhook verification. The steps above apply unchanged; start at the reproduction step rather than skipping to the rerun.

Delighted webhook verification troubleshooting for this failure

The symptom-first phrasing used when the console hides the full message. Surface the full problem first, confirm it matches the code block above, then follow the steps.

Compatibility: Delighted webhook verification at current versions, plus the platform API or console the query names; no extra tooling beyond the source system access needed to verify counts.

Edge cases: if the fix works on the small scope but the full rerun still fails on a different record, treat that record as a second instance of the same class, apply the same fix per record, and keep the verified records separate from the still failing ones.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Qp0KbP0vLIKZX9lljmI-cA