Base64 Secret Padding Mismatch Between Environments

Problem

Webhooks or API calls fail authorization even though the secret "looks correct" when comparing environment variables between systems. The root cause is Base64 padding characters (=) being silently dropped when copying or displaying secrets.

Context / Trigger Conditions

• Webhook handler returns "Unauthorized" or generic "Server Error"
• Error occurs in mutation/database call after webhook validation passes
• Secret was copy-pasted between systems (e.g., Railway → Convex, Vercel → Supabase)
• CLI tools show the secret without trailing = characters
• The secret is Base64-encoded (often ends with = or ==)