# Stripe webhook signature verification failed: timestamp out of tolerance

- **ID:** `api/stripe-webhook-signature-verification-failed-timestamp`
- **Domain:** api
- **Category:** auth_error
- **Verification:** ai_generated
- **Fix Rate:** 85%

## Root Cause

The webhook event's timestamp differs from the server's clock by more than the allowed tolerance (usually 5 minutes), causing signature verification to fail.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Stripe API 2023-10-16 | active | — | — |
| stripe-python v7.0 | active | — | — |
| stripe-node v14.0 | active | — | — |

## Workarounds

1. **Sync the server's clock using NTP (e.g., `sudo ntpdate pool.ntp.org` on Linux) and ensure NTP daemon is running.** (90% success)
   ```
   Sync the server's clock using NTP (e.g., `sudo ntpdate pool.ntp.org` on Linux) and ensure NTP daemon is running.
   ```
2. **Increase the tolerance window in the Stripe SDK by passing a custom `tolerance` parameter (e.g., `stripe.webhook.construct_event(payload, sig_header, secret, tolerance=300)` in Python).** (85% success)
   ```
   Increase the tolerance window in the Stripe SDK by passing a custom `tolerance` parameter (e.g., `stripe.webhook.construct_event(payload, sig_header, secret, tolerance=300)` in Python).
   ```

## Dead Ends

- **** — Exposes the endpoint to replay attacks and invalid events. (100% fail)
- **** — Clock drift is a symptom; manual adjustment is temporary and may break other services. (80% fail)