X_WEBHOOK_SIGNATURE_STALE

the inbound webhook is signed correctly and is too old to accept

the mac verified and the timestamp sits further than toleranceMs (default 300,000 ms) from this clock — a sender's clock, or a delivery replayed off a capture. The mac is checked before the window, deliberately, so this code always means "authentic and old" and never "unreadable and old". Both directions of skew count: a sender running ahead is the same replay window pointed the other way, and accepting the future half doubles it. Same 401 as above — the credential is a timestamped one and this is its expiry half

sync the sending host clock with NTP, or widen the window with verifyWebhookSignature(request, { secret, toleranceMs: 600_000 }) if the sender queues deliveries for longer than that