Error code: webhook_signature_missing

What triggers it

A webhook arrived without a signature header. The Credicorp-Signature header was absent — usually a proxy stripping headers.

Example response

{
  "error": {
    "type": "invalid_request_error",
    "code": "webhook_signature_missing",
    "message": "A webhook arrived without a signature header."
  }
}

How to fix it

Reject the request; ensure your proxy forwards the Credicorp-Signature header intact.

This is deterministic; fix the cause before resending. See the error code catalogue for related codes.

In practice

In a well-built client, webhook_signature_missing is handled by branching on error.code rather than on the human error.message, which may be reworded over time. The HTTP status (400) gives the broad invalid_request_error class; the code gives the specifics; and, on field errors, error.param pinpoints the input to fix.

This code is deterministic — retrying the identical request reproduces it — so keep it out of your retry path and instead map it to a clear, actionable message. See Map errors to user-facing messages and Read the error envelope for the pattern.