GitHub webhook configuration could not be confirmed. Reconne

Error message

GitHub webhook configuration could not be confirmed. Reconnect to retry; repository access was not changed.

What it means

Thrown by resyncGitHubAppWebhook in the Paperclip server when the PATCH/POST fetch to GitHub's webhook configuration endpoint rejects (network error, DNS failure, TLS error, etc.). The catch block deliberately swallows the underlying fetch error because fetch errors can embed request bodies, headers, or proxy responses, so the raw cause is never surfaced to endpoint health, audit logs, or the board. The safe retry path is reconnecting the GitHub connection; repository access grants are untouched.

Source

Thrown at server/src/services/chat-github-webhook-config.ts:730

      redirect: "error",
      signal: AbortSignal.timeout(25_000),
      headers: {
        accept: "application/vnd.github+json",
        authorization: `Bearer ${input.appToken}`,
        "content-type": "application/json",
        "x-github-api-version": "2022-11-28",
      },
      body: JSON.stringify({
        url: input.webhookUrl,
        content_type: "json",
        insecure_ssl: "0",
        secret: input.webhookSecret,
      }),
    });
  } catch {
    // A fetch error can embed request bodies, headers, or a proxy response.
    // Keep it out of endpoint health, the audit log, and the board response.
    throw new Error(
      "GitHub webhook configuration could not be confirmed. Reconnect to retry; repository access was not changed.",
    );
  }
  if (response.status !== 200) {
    await response.body?.cancel().catch(() => undefined);
    throw new Error(
      `GitHub could not update this App's webhook (HTTP ${response.status}). Check that the App is active and reconnect.`,
    );
  }

  // GitHub can echo a masked secret and provider error bodies are untrusted.
  // Read a bounded response and return no provider body to callers or logs.
  let config: Record<string, unknown>;
  const reader = response.body?.getReader();
  try {
    if (!reader) throw new Error("Missing webhook configuration response");
    const chunks: Uint8Array[] = [];
    let size = 0;

View on GitHub (pinned to 01ad858492)

Solutions

Reconnect the GitHub App connection in the Paperclip board to retry the resync.
Verify outbound HTTPS access to api.github.com from the server (curl -I https://api.github.com).
Check proxy/HTTPS_PROXY environment variables and corporate firewall egress rules.
Retry after a transient network failure resolves; check server logs for the earlier fetch failures in the same window.

Defensive patterns

Strategy: retry

Validate before calling

// Before resync, confirm outbound reachability:
const ok = await fetch('https://api.github.com/zen', { method: 'GET' }).then(r => r.ok).catch(() => false);
if (!ok) throw new Error('No outbound access to api.github.com; fix network before resync');

Try / catch

try { await resyncGitHubAppWebhook(input); }
catch (e) {
  if (e.message.includes('could not be confirmed')) {
    // transient network path; schedule a retry with backoff
    await retryWithBackoff(() => resyncGitHubAppWebhook(input), 3);
  } else throw e;
}

Prevention

Ensure stable egress to api.github.com (allowlist in firewalls/proxies).
Set and verify HTTPS_PROXY vars in containerized environments.
Monitor network health and retry resyncs automatically with backoff.
Avoid aborting in-flight resync requests (client timeouts).

When it happens

Trigger: The fetch() call to GitHub's API for updating the GitHub App's webhook config throws: network outage, DNS failure, proxy interference, TLS handshake failure, aborted request, or an invalid webhookSecret being encoded into the request causing an undispatched request error.

Common situations: Corporate proxy blocking api.github.com; transient network blips during App reconnect; Docker/container networking issues; firewall egress rules dropping the outbound call; request aborted by a client disconnect mid-resync.

Related errors

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-09-10). Data as JSON: /api/errors/c3051cc2fc41a63f. Report an issue: GitHub.