JWT signature verification failing on Express webhook listener

GC runs 2024-9.900.0. The Express middleware catches interaction.wrapup events, but JWT verification bombs on the Authorization header. jsonwebtoken throws JsonWebTokenError: invalid signature. Clock skew’s set to 60 seconds, yet the payload timestamp drifts by 120 seconds during peak load.

jwt.verify returns the error immediately. Rotating the API key did jack all. The payload structure looks solid, keys match, but the HMAC calculation mismatches.

GC webhooks use RSA-SHA256, not the symmetric secret you’re likely passing to jwt.verify. Grab the public key from the org settings and verify the signature algorithm explicitly.