# braintree webhook payload signature mismatch: rotated public key

## TL;DR
Your stored Braintree public key no longer matches the key that signed the notification. Fetch the current public key from the gateway dashboard and update your webhook verification config, then re-verify the pending notification. Rotations are the most common cause of sudden all-webhooks-failing verification.

```text
braintree webhook payload signature mismatch: rotated public key
```

## Steps

1. Confirm the rotation: compare the public key your code uses against the current one in the Braintree dashboard. Success check: you can point to the key that changed and when.
2. Update the stored public key in your app config (or the key source the agent reads). Success check: your config now matches the dashboard value.
3. Re-run signature verification on a saved copy of a failed notification. Success check: verification passes with the new key.
4. Ask Braintree to resend (or replay from your log) any notifications that failed during the gap. Success check: the missed events are reprocessed in order.
5. Add a key-rotation runbook step: alert before rotation, swap during a quiet window, and keep the old key for a short overlap to catch in-flight notifications. Success check: the next rotation needs no firefighting.

## When this applies

- Braintree webhook notifications fail signature verification right after a key rotation.
- Every notification fails at once, not just one payment.
- Sandbox works but production fails (or vice versa), hinting at per-environment keys.

## When it doesn't

- Notifications never arriving at all; that is delivery, not signature verification.
- Replay attacks or tampered payloads; those fail for a different reason.
- Signature failures with no recent rotation; check key formatting instead.

## Tool + version compatibility

Braintree webhooks and webhook notification parsing in all current gateway SDKs.

### "braintree webhook signature verification failed after key rotation"
Same fix. The rotation is the trigger; update the stored key and re-verify.

### "braintree notification signature mismatch new key"
Compare dashboard key to stored key first. Most cases resolve there.

### "braintree public key rotated webhooks failing"
Swap the key, replay the gap, and add an overlap window next time.

## Why it happens

Braintree signs each webhook payload with the public key currently active on the gateway. When someone rotates that key, the signature on new notifications changes instantly, but your code keeps verifying against the old value. Everything fails until the two sides agree again. Agent-built integrations that hardcode the key at setup time are the most exposed.

## Edge cases / pitfalls

- Keep the old key accepted for a short overlap window so in-flight notifications are not dropped.
- Rotate sandbox and production keys independently; one dashboard change does not update both.
- Log which key verified each notification so the next mismatch is a two-minute diagnosis.
- Never commit the new key to a public repo while rushing the fix; rotation urgency is how keys leak.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_U_TaNQuTypmR8BC816YPeQ