{"record":{"id":"6775fd0c2a2630fb","repo":"Dokploy/dokploy","slug":"github-webhook-secret-not-set","errorCode":null,"errorMessage":"Github Webhook Secret not set","messagePattern":"Github Webhook Secret not set","errorType":"http","errorClass":null,"httpStatus":400,"severity":"error","filePath":"apps/dokploy/pages/api/deploy/github.ts","lineNumber":56,"sourceCode":"\n\tconst githubBody = req.body;\n\n\tif (!githubBody?.installation?.id) {\n\t\tres.status(400).json({ message: \"Github Installation not found\" });\n\t\treturn;\n\t}\n\n\tconst githubResult = await db.query.github.findFirst({\n\t\twhere: eq(github.githubInstallationId, githubBody.installation.id),\n\t});\n\n\tif (!githubResult) {\n\t\tres.status(400).json({ message: \"Github Installation not found\" });\n\t\treturn;\n\t}\n\n\tif (!githubResult.githubWebhookSecret) {\n\t\tres.status(400).json({ message: \"Github Webhook Secret not set\" });\n\t\treturn;\n\t}\n\tconst webhooks = new Webhooks({\n\t\tsecret: githubResult.githubWebhookSecret,\n\t});\n\n\tconst verified = await webhooks.verify(\n\t\tJSON.stringify(githubBody),\n\t\tsignature as string,\n\t);\n\n\tif (!verified) {\n\t\tres.status(401).json({ message: \"Unauthorized\" });\n\t\treturn;\n\t}\n\n\tif (req.headers[\"x-github-event\"] === \"ping\") {\n\t\tres.status(200).json({ message: \"Ping received, webhook is active\" });","sourceCodeStart":38,"sourceCodeEnd":74,"githubUrl":"https://github.com/Dokploy/dokploy/blob/546686ea3587f12ec5652217dedd9f7960fb6d15/apps/dokploy/pages/api/deploy/github.ts#L38-L74","documentation":"The github provider row exists but githubWebhookSecret is empty, so the handler cannot verify the HMAC signature and returns 400 'Github Webhook Secret not set' before signature validation.","triggerScenarios":"Provider created without saving a webhook secret; secret field cleared; secret saved on the GitHub App side but not copied into Dokploy provider settings.","commonSituations":"Setup flow skipped the webhook secret; secret rotated on GitHub but not updated in Dokploy; older Dokploy version rows lacking the column value.","solutions":["Set the same webhook secret in both the GitHub App settings and the Dokploy Github provider","Redeliver a webhook event from GitHub after saving to confirm verification passes","If secret was rotated, update both sides to the identical value"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (!provider.githubWebhookSecret) throw new Error('Set the webhook secret in the provider settings');","typeGuard":"const hasWebhookSecret = (p: Github | null): p is Github & { githubWebhookSecret: string } =>\n  typeof p?.githubWebhookSecret === 'string' && p.githubWebhookSecret.length > 0;","tryCatchPattern":"const r = await fetch('/api/deploy/github', ...);\nif (r.status === 400 && (await r.json()).message === 'Github Webhook Secret not set') { await saveWebhookSecret(id, secret); retry(); }","preventionTips":["Set the webhook secret at provider creation time","Rotate secrets on both GitHub and Dokploy together","Add UI validation preventing provider save without the secret"],"tags":["github","webhook","secret","configuration"],"backgroundTag":"webhook-secret-not-set","analyzedSha":"546686ea3587f12ec5652217dedd9f7960fb6d15","analyzedAt":"2026-08-27T05:18:58.095Z","schemaVersion":2},"datasetVersion":"2026-08-27T08:17:20.692Z"}