# X_WEBHOOK_SIGNATURE_STALE

## Means

the inbound webhook is signed correctly and is too old to accept

## Typical cause

the mac verified and the timestamp sits further than `toleranceMs` (default 300,000 ms) from this clock — a sender's clock, or a delivery replayed off a capture. The mac is checked **before** the window, deliberately, so this code always means "authentic and old" and never "unreadable and old". Both directions of skew count: a sender running ahead is the same replay window pointed the other way, and accepting the future half doubles it. Same 401 as above — the credential is a timestamped one and this is its expiry half

## Fix

sync the sending host clock with NTP, or widen the window with `verifyWebhookSignature(request, { secret, toleranceMs: 600_000 })` if the sender queues deliveries for longer than that

[HTTP](/error-codes#http)