Aglet

Investigate webhook signing secret rollover

Investigation should show which endpoint or deployment still uses the wrong secret version. Build old, new, overlap, expired-old, wrong-endpoint, and missing-config fixtures, then trace version labels. Keep secret material out and treat rotation timing as a separate evidence boundary during every receiver deployment.

Build a useful investigation brief

  1. Build rollover fixtures

    Create synthetic verification cases for old and new version labels, allowed overlap, expired old value, wrong endpoint, missing config, and receiver restart. Record expected result before execution. Preserve endpoint identity in each fixture.

  2. Trace version propagation

    Capture rotation label, secure configuration reference, deployment revision, endpoint, signature metadata, verifier selection, and final disposition. Compare first divergence between receiver versions. Never include the signing value in output. Keep version labels separate from secret values.

  3. Vary deployment timing

    Change only endpoint, environment, receiver revision, overlap state, clock, or secret label. Compare verification and backlog. If a sender’s rotation schedule is unobserved, state that limitation rather than inventing a grace period. Document the source timing.

What to carry forward

The investigation is ready when versioned fixtures show rotation, configuration, deployment, verification, and delivery boundaries. Deliver a secure configuration or rollout change. Keep sender overlap behavior explicit when unverified. Keep rotation timing separate from endpoint configuration.

Technical background: Stripe documentation.

Keep the decision with the work.

Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.

Create an account See the product workflow