A 400 in the webhook log means your store refused the delivery because its signature did not verify. Nothing changed on the order. Almost always, the webhook secret in KahunaCart does not match the one the provider generated.
A Current streak above zero in bin/plugin kahunacart webhooks counts the deliveries in a row that have failed since the last good one. KahunaCart never disables a provider because of it.
Common causes
| Provider | Common causes |
|---|---|
| Stripe | A secret from the other mode; the dashboard secret in place while forwarding with stripe listen, which prints its own; a server clock more than 300 seconds out |
| Polar | The endpoint is not set to the Raw format in Polar; the secret was decoded before it was pasted |
| PayPal | No webhook ID configured; a secret entered where the webhook ID belongs |
Fix it
- Press Set up webhook on the provider's card at KahunaCart → Setup → Payments. It saves the matching secret or webhook ID for the current mode.
- If you entered the secret by hand, confirm it belongs to the mode the store is running in.
- For Stripe, check the server clock is correct.
- For Polar, paste the secret exactly as Polar gives it.
- For PayPal, enter the webhook ID (like
1JE43649LP004314D) in the webhook ID field for your mode, not a secret. - Redeliver the failed webhooks from the provider's dashboard.
Note
An empty webhook secret rejects every delivery. It never means "accept unverified".