Stripe webhook · server log

Timestamp outside the tolerance zone

StripeSignatureVerificationError: Timestamp outside the tolerance zone

What it means

The stripe-signature header carries a timestamp, and the library rejects events older than the tolerance (300 seconds by default) to stop replay attacks. Either your server clock is off, or you're replaying an old saved payload.

Common causes

• Server or container clock drift (no NTP)
• Replaying a saved request from a fixture or log
• Queueing the raw request and verifying it minutes later

How to fix it

1. Sync the server clock (NTP) and check date -u against real UTC
2. Verify the signature as soon as the request arrives, then queue the parsed event
3. For tests, generate fresh headers with stripe.webhooks.generateTestHeaderString instead of old ones

$ date -u   # should match real UTC
$ stripe listen --forward-to localhost:3000/api/stripe/webhook
# put the whsec_... it prints in .env.local, then restart npm run dev
$ stripe trigger checkout.session.completed

Prompt for Cursor or Claude Code

My Stripe webhook fails with 'Timestamp outside the tolerance zone'. Check whether verification happens immediately on receipt or later from a queue, and whether tests replay stale signed payloads. Make verification run on receipt and use stripe.webhooks.generateTestHeaderString in tests. Don't raise the tolerance.

Not quite your error? Paste yours into the free VibeBoot Doctor or browse the Stripe webhook fixer.