Stripe webhook · Stripe Dashboard

401 / 403 from auth middleware or Vercel Deployment Protection

Webhook delivery failed: HTTP status code 401 (Unauthorized)

What it means

Something answered before your handler ran. Stripe has no session cookie, so auth middleware rejects it or redirects it to sign-in. On Vercel, Deployment Protection (Vercel Authentication) blocks preview deployments, and sometimes production, with a 401.

Common causes

• proxy.ts / middleware.ts protects /api/* and the matcher doesn't exclude the webhook
• Vercel Deployment Protection is on for the URL Stripe calls (often a preview URL)
• Cloudflare / WAF bot protection challenges Stripe's requests
• Basic auth on a staging site

How to fix it

1. Exclude /api/stripe/webhook from the middleware matcher: the Stripe signature is its authentication
2. Point Stripe at your production domain, not a *.vercel.app preview URL
3. Or turn off Deployment Protection for that URL, or use Vercel's Protection Bypass for Automation
4. Allow Stripe's webhook IPs through your WAF if needed

export const config = {
  // run everywhere except static files and the Stripe webhook
  matcher: ["/((?!api/stripe/webhook|_next/static|_next/image|favicon.ico).*)"],
};

$ curl -i -X POST https://<your-domain>/api/stripe/webhook
# expect 400 (missing signature) from your handler, not 3xx, 401, 403, 404 or 405
$ stripe events resend evt_... --webhook-endpoint=we_...
# we_... is the endpoint id in the Dashboard; add --live for a live-mode event

Prompt for Cursor or Claude Code

Stripe gets 401/403 from my webhook. Find every proxy.ts/middleware.ts matcher, auth check or wrapper that runs on /api/stripe/webhook and exclude that route, keeping signature verification as its only auth. Also tell me if the URL in Stripe is a Vercel preview URL behind Deployment Protection.

Not quite your error? Paste yours into the free VibeBoot Doctor or browse the Stripe webhook fixer.