Establish what is happening
Capture rotation context
Record endpoint, environment, secret version label, rotation time, receiver revision, header metadata, and verification result. Never log the secret. Note whether the failure began at rotation or only after an overlap window ended. Keep endpoint identity beside the version label.
Compare receiver states
Use synthetic old, new, overlap, expired-old, wrong-endpoint, and missing-configuration fixtures. Compare accepted or rejected state and deployment timing. Keep a valid signature with its secret label, not secret material. Keep endpoint identity beside each fixture.
Bound affected delivery
Group failures by endpoint, environment, receiver revision, secret label, and delivery age. Separate configuration lag, rotation policy, clock, and wrong endpoint. Quarantine unverifiable deliveries and preserve safe event identity. Record pending event identity separately.
What to carry forward
Triage ends with endpoint and version labels, deployment boundary, affected deliveries, and evidence gap. Keep verification strict while rotation is uncertain. Route secret configuration, deployment, and timing questions separately. Keep unverifiable events quarantined until version evidence is complete.
Technical background: Stripe documentation.
Keep the decision with the work.
Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.
Create an account See the product workflow