Error catalog

E_BILLING_WEBHOOK_UNSIGNED

The billing webhook refused an event

An event reached /webhooks/billing without a valid HMAC over timestamp.body, with a timestamp more than five minutes away from now, or with no billing-webhook connection to check it against. Every one of these is the same 401 on purpose: saying which part failed tells a stranger how close they got.

Fix

Create the connection named billing-webhook with the secret the provider signs with, check the provider sends X-Webhook-Timestamp and X-Webhook-Signature over the raw body, and that both clocks agree within five minutes.

curl -X POST https://example.com/webhooks/billing -H 'X-Webhook-Timestamp: 1790000000' -H 'X-Webhook-Signature: sha256=…' --data-binary @event.json