remotion-dev/remotion · error · TypeError

No 'secret' was provided to validateWebhookSignature().

Error message

No 'secret' was provided to validateWebhookSignature().

What it means

Thrown by validateWebhookSignature() in @remotion/lambda-client when the `secret` argument is falsy (empty string, null, undefined). The secret is the HMAC key used to verify that an incoming render-progress webhook genuinely came from your Lambda; without it, no signature can be trusted.

Source

Thrown at packages/lambda-client/src/validate-webhook-signature.ts:15

/*
 * @description Validates that the signature received by a webhook endpoint is authentic. If validation fails, an error is thrown.
 * @see [Documentation](https://remotion.dev/docs/lambda/validatewebhooksignature)
 */
export const validateWebhookSignature = ({
	secret,
	body,
	signatureHeader,
}: {
	secret: string;
	body: unknown;
	signatureHeader: string;
}) => {
	if (!secret) {
		throw new TypeError(
			"No 'secret' was provided to validateWebhookSignature().",
		);
	}

	if (!body) {
		throw new TypeError(
			"No 'body' was provided to validateWebhookSignature().",
		);
	}

	if (typeof require === 'undefined') {
		throw new Error('validateWebhookSignature can only be called from Node.JS');
	}

	const Crypto = require('crypto');

	const hmac = Crypto.createHmac('sha512', secret);
	const signature = `sha512=${hmac.update(JSON.stringify(body)).digest('hex')}`;

View on GitHub (pinned to 78fe4bb3fd)

Solutions

1. Ensure the webhook secret env var (e.g. REMOTION_WEBHOOK_SECRET) is set on every environment that handles webhooks, and pass it explicitly.
2. Fail fast at app boot if the secret is missing rather than per-request.
3. Confirm you are reading the same secret that was configured when deploying the Lambda function.

Example fix

// before
validateWebhookSignature({secret: process.env.WEBHOOK_SECRET, body, signatureHeader});

// after
const secret = process.env.WEBHOOK_SECRET;
if (!secret) throw new Error('WEBHOOK_SECRET not configured');
validateWebhookSignature({secret, body, signatureHeader});

const secret = process.env.REMOTION_WEBHOOK_SECRET;
if (!secret) throw new Error('REMOTION_WEBHOOK_SECRET is not set');
validateWebhookSignature({secret, body, signatureHeader});

const hasSecret = (s: unknown): s is string => typeof s === 'string' && s.length > 0;

try {
  validateWebhookSignature({secret, body, signatureHeader});
} catch (err) {
  // Treat ANY validation failure as unauthenticated — do not leak which check failed.
  return res.status(401).send('unauthorized');
}

When it happens

Trigger: Calling validateWebhookSignature({secret: '', ...}) or passing secret: undefined / null. The guard is a simple `if (!secret)` so any falsy value trips it.

Common situations: Reading the webhook secret from an env var that is not set in the current environment; passing the wrong key name; initializing the secret lazily and hitting the route before initialization completed.

Related errors

• No 'body' was provided to validateWebhookSignature().
• No webhook signature was provided
• Signatures do not match
• Invalid public file path: ${path}
• The public directory was specified as "${p}", which is the r

AI-assisted analysis of remotion-dev/remotion@78fe4bb3fd (2026-08-12). Data as JSON: /api/errors/cb46aab1e12c0b8f. Report an issue: GitHub.