Stripe webhook verification rejects payloads outside a 300-second default timestamp tolerance

The Stripe-Signature header carries a t field holding a Unix timestamp alongside one or more v1 HMACs, and the signed string is the timestamp, a literal period, then the raw body. The library compares that timestamp against current time and rejects anything outside a tolerance defaulting to 300 seconds, raising an error whose message contains Timestamp outside the tolerance zone.

This is a replay guard, not a delivery guard, so a server whose clock has drifted more than five minutes rejects every live event while the identical code passes locally. Confirm by comparing the server's UTC clock against a known time source. Fix drift with NTP rather than widening the tolerance; the tolerance argument exists mainly so recorded fixtures can be replayed in tests, where passing zero disables the check entirely.