Dokploy/dokploy · error

Github Webhook Secret not set

Error message

Github Webhook Secret not set

What it means

The github provider row exists but githubWebhookSecret is empty, so the handler cannot verify the HMAC signature and returns 400 'Github Webhook Secret not set' before signature validation.

Source

Thrown at apps/dokploy/pages/api/deploy/github.ts:56

	const githubBody = req.body;

	if (!githubBody?.installation?.id) {
		res.status(400).json({ message: "Github Installation not found" });
		return;
	}

	const githubResult = await db.query.github.findFirst({
		where: eq(github.githubInstallationId, githubBody.installation.id),
	});

	if (!githubResult) {
		res.status(400).json({ message: "Github Installation not found" });
		return;
	}

	if (!githubResult.githubWebhookSecret) {
		res.status(400).json({ message: "Github Webhook Secret not set" });
		return;
	}
	const webhooks = new Webhooks({
		secret: githubResult.githubWebhookSecret,
	});

	const verified = await webhooks.verify(
		JSON.stringify(githubBody),
		signature as string,
	);

	if (!verified) {
		res.status(401).json({ message: "Unauthorized" });
		return;
	}

	if (req.headers["x-github-event"] === "ping") {
		res.status(200).json({ message: "Ping received, webhook is active" });

View on GitHub (pinned to 546686ea35)

Solutions

1. Set the same webhook secret in both the GitHub App settings and the Dokploy Github provider
2. Redeliver a webhook event from GitHub after saving to confirm verification passes
3. If secret was rotated, update both sides to the identical value

if (!provider.githubWebhookSecret) throw new Error('Set the webhook secret in the provider settings');

const hasWebhookSecret = (p: Github | null): p is Github & { githubWebhookSecret: string } =>
  typeof p?.githubWebhookSecret === 'string' && p.githubWebhookSecret.length > 0;

const r = await fetch('/api/deploy/github', ...);
if (r.status === 400 && (await r.json()).message === 'Github Webhook Secret not set') { await saveWebhookSecret(id, secret); retry(); }

When it happens

Trigger: Provider created without saving a webhook secret; secret field cleared; secret saved on the GitHub App side but not copied into Dokploy provider settings.

Common situations: Setup flow skipped the webhook secret; secret rotated on GitHub but not updated in Dokploy; older Dokploy version rows lacking the column value.

Related errors

• Github Installation not found
• BAD_REQUEST
• BAD_REQUEST
• Automatic deployments are disabled for this application
• Error deploying Application

AI-assisted analysis of Dokploy/dokploy@546686ea35 (2026-08-27). Data as JSON: /api/errors/6775fd0c2a2630fb. Report an issue: GitHub.