Keep verification enabled, reject mismatches, and diagnose the exact request and provider configuration before replaying deliveries. A signature mismatch is a security boundary, not a reason to accept the payload temporarily. First establish what the provider signed and what your server actually received; then restore verification and recover missed events safely.
Why a verification failure needs careful handling
Webhook signatures let your application check that a delivery matches the provider’s signing scheme and configured secret. Until that check succeeds, do not trust or process the event contents. GitHub recommends validating a delivery before further processing; Shopify’s developer documentation says to verify HMAC before trusting payload contents and to reject deliveries with mismatched signatures.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
APIs and Webhooks for Beginners: Connect Apps, Automate Tasks, and Build Useful Integrations | $2.99 | Buy on Amazon |
| 2 |
|
Shelly Pro 3EM 3CT 63 Wi-Fi & LAN 3-Phase Smart Energy Meter | $150.99 | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
A valid signature does not guarantee that an event is fresh, unique, in order, or safe to apply twice. Authentication and business processing are separate checks: verify the delivery, then handle duplicates and event state appropriately.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsTriage the failure in production
1. Establish what changed and what is affected
Identify the provider, endpoint or subscription, the first failure time, affected event types, and whether failures affect every delivery or only a subset. Check recent changes to the configured secret, environment variables, framework or middleware, proxy or API gateway, and character encoding. Treat these as leads to confirm, not as diagnoses.
#1 Best Overall
2. Find one delivery and correlate its records
In the provider’s delivery dashboard or API, locate a failed attempt and record its delivery identifier, event type, timestamp, response status, and any provider-reported error. Match that attempt to application and gateway logs using the identifier and time. GitHub recommends checking recent delivery records and server logs; it also distinguishes a failed attempt from an event that was never attempted or is delayed. If no GitHub delivery appears, check the subscription and allow a few minutes for delivery records to appear.
Keep secrets out of logs, source control, URLs, incident tickets, and screenshots. Log only the request metadata and payload details necessary and permitted to diagnose the failure.
3. Confirm the provider’s signing contract and secret
Check the documentation for the specific provider and endpoint: signing header, algorithm, digest representation, signing input, and configured production secret. Do not assume that one provider’s header or algorithm applies to another. For GitHub, use the X-Hub-Signature-256 header with HMAC-SHA256 and the webhook secret configured for that endpoint. GitHub says the signature header is absent if no secret was configured. Its documentation recommends storing the secret securely rather than hardcoding or committing it.
Check that the running production process has the intended secret, not a staging value, an empty value, or an outdated value. If the secret was recently changed, confirm the provider and receiver are configured consistently; do not assume a universal rotation overlap or timestamp window.
4. Verify the exact bytes received
Signature verification must use the request body in the form required by the provider, not a parsed JSON object that your application later serializes again. Parsing and reserialization can change whitespace, escaping, or other bytes and cause a mismatch even when the event looks identical when printed.
Inspect the request path through the application: whether middleware reads or transforms the body first, whether a parser runs before verification, whether the body is consumed, and whether a proxy, gateway, or load balancer changes the payload or headers. Shopify explicitly requires the raw request body for verification and warns that a body parser such as express.json() can run too early. GitHub warns that proxies and load balancers must not modify payloads or headers. Also check character encoding; GitHub calls out UTF-8 handling for relevant language and server implementations.
Compare byte-level behavior with a controlled fixture, and avoid printing secrets or sensitive payloads into shared logs. A parsed-object comparison is not a substitute for checking the bytes passed to the verifier.
Rank #2
- The Shelly Pro 3EM 3CT 63 is a next-gen DIN rail-mountable energy meter for single or three-phase installations, featuring a 63A, 3-phase current transformer for non-contact measurements. It supports 4-quadrant measurement, optical pulse indication of energy usage, and is photovoltaic-ready. *It doesn't have a built-in relay; contactor control requires a Shelly Pro Addon attached to the device.
- Professional Smart Meter - Shelly Pro 3EM-3CT63 is a professional smart meter that reports accumulated energy, voltage, current, active, and apparent power per phase in real time. It stores data for up to 60 days in 1-minute intervals and includes a real-time clock to maintain accurate time if the SNTP server connection is lost.
- Ideal for business energy measurement - In commercial buildings, it helps monitor energy usage across floors or departments allowing accurate cost allocation and identification of energy wastage. In manufacturing plants it tracks energy consumption of heavy machinery, optimizing usage to reduce operational costs. For store owners it monitors energy usage of systems like lighting, HVAC § refrigeration, helping to identify inefficiencies § reduce energy bills while supporting sustainable practices
- Shelly Customer Service - Shelly is one of the fastest-growing Smart Home brands in the world with devices, providing solutions for the automation of private homes, buildings and businesses. We provide our customers with professional support and a 5 years device warranty.
- Shelly Smart Control App will help you control your Shelly devices remotely and will send notifications for all automated events in your home. You can easily configure devices and manage their settings individually, or you can create personalized scenes by combining Shelly devices to trigger certain actions in your home automation.
5. Restore verification and prove both stages work
Correct the confirmed configuration or request-body issue, deploy through your normal safe process, and check a legitimate provider delivery or provider-supported test. Invalid signatures must still be rejected. Confirm the receiver returns the expected acknowledgment, then separately confirm that the event was durably accepted and downstream processing completed; a valid signature alone does not prove business processing succeeded.
Recover deliveries after verification is healthy
Do not replay deliveries into a receiver whose verification is still failing or disabled. Once the trust check works, use the affected provider’s redelivery mechanism or another provider-supported reconciliation path, and verify event state after recovery.
Make effects idempotent so a retry or redelivery cannot apply the same business operation twice. Use the provider’s delivery identifier for deduplication where appropriate: Shopify documents X-Shopify-Webhook-Id, while GitHub documents X-GitHub-Delivery and says redelivery retains the original ID. Confirm whether your workflow also needs a separate event ID for correlation. GitHub notes that deliveries can arrive out of order, so do not use arrival order as proof of event order.
Meet the provider’s acknowledgment deadline
Webhook deadlines and retry behavior are provider-specific. For the providers covered here, current documentation accessed in 2026 states:
Free tools Windows power users keep installed
One-click scans. No signup required.
| Provider | Response timing | Retry or delivery consequence | Documented delivery ID |
|---|---|---|---|
| GitHub | GitHub Docs says the server should return a 2xx response within 10 seconds; otherwise GitHub terminates the delivery and considers it failed. | The cited guidance does not state a retry count or retry schedule. | X-GitHub-Delivery; GitHub says redelivery retains the original ID. |
| Shopify | Shopify Developer Documentation states a one-second connection timeout and a five-second total timeout for HTTPS deliveries, and expects HTTP 200. | Shopify documents eight retries over four hours. After eight consecutive failures, a subscription configured using the Admin API is automatically deleted. | X-Shopify-Webhook-Id. |
These limits describe the named providers, not a universal webhook contract. Check the affected provider’s current documentation before changing acknowledgment behavior. If synchronous work cannot meet that provider’s deadline, persist the delivery to a durable queue and acknowledge only after durable acceptance; process it asynchronously with backpressure and idempotent effects. A queue adds operational complexity, but it separates fast receipt from slower business work without acknowledging an event that has not been safely accepted.
Choose an implementation that preserves the trust boundary
| Approach | Best fit | Check before adopting |
|---|---|---|
| Provider-supported SDK or framework middleware | When the provider offers a maintained integration that matches your runtime and endpoint setup. | Confirm it verifies the intended endpoint and secret, has access to the raw body, exposes useful failure information, and can be upgraded and tested. Shopify documents automatic verification in its React Router template. |
| Manual provider-specific verification | When supported middleware does not fit the application or you need direct control of request handling. | Follow that provider’s signing contract exactly and test raw-body handling, encoding, mismatch rejection, and secret configuration. Shopify documents a manual raw-body HMAC option. |
| Synchronous processing before acknowledgment | When the full operation reliably fits the provider’s response deadline and failures can be handled safely. | Account for slow dependencies, load spikes, and what happens if processing succeeds but the acknowledgment is lost. |
| Durable queue, then acknowledgment | When downstream work may exceed the provider’s deadline or needs independent retry and backpressure handling. | Ensure acceptance is durable before returning success, and make later processing idempotent. This adds queue operations and monitoring responsibilities. |
Deduplication can happen at receipt or through idempotent downstream operations. An inline dedupe record can prevent repeated work early, but requires durable storage and concurrency-safe handling. Idempotent effects protect business operations farther downstream, but require each affected operation to tolerate repeats. Many systems need both; the provider’s delivery ID and the business event’s identity may serve different purposes.
Keep transport and access controls in perspective
Use HTTPS and keep SSL verification enabled, as GitHub recommends. An IP allowlist can be an additional network control, but it is not a replacement for signature validation; GitHub also warns that its delivery IP addresses can change, so allowlists need periodic updates. A request from an expected network location still needs the provider-specific signature check.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Recommended Free Tools
