Webhook routes were only registered in app.js (the test factory) but not in index.js (the production entry point). POST /api/webhook/* was therefore falling through to the verifyCsrf middleware and being rejected with 403 in production.
Webhook routes were only registered in app.js (the test factory) but not in index.js (the production entry point). POST /api/webhook/* was therefore falling through to the verifyCsrf middleware and being rejected with 403 in production.