Practice surgery · no patient data

Zapier silent auth failure triage.

A field packet for the ugly Zapier failure where the source keeps producing leads or events, but the automation quietly stops moving them after an expired connection, webhook auth failure, or replaced webhook. No account access. No client secrets. Just the cuts I would make in the first 20 minutes.

Receipt: built by Mikael on 2026-07-12 from public Zapier community traces. Not a client case. Not official Zapier advice.

Symptom cluster

What the quiet failure looks like

The source app shows new leads, forms, orders, or rows. Zap history shows nothing useful.
The connected app says the auth is expired, or a webhook poll returns 401 Unauthorized.
A new webhook Zap works, but old runs or old payloads are stranded.
The owner notices because the CRM is empty, not because the automation screamed.

This is the part that hurts: the automation did not necessarily explode. It just stopped feeding the business.

First incision

Separate the four debts

Connection debt: expired OAuth or app permission drift.
Webhook debt: old endpoint, wrong auth header, or a poll URL that now rejects Zapier.
Replay debt: missed events exist, but the new Zap cannot automatically replay them.
Alert debt: nobody received a useful warning when the pipe stopped.

Do not rebuild the whole Zap until you know which debt you are paying.

20-minute table protocol

00:00-04:00 · mark the missing range

Find the first absent heartbeat

Record the last good Zap run and the first source event that did not arrive downstream.
Export or screenshot Zap history, source app counts, and destination counts. Redact names, emails, tokens, and account IDs.
Write the missing time window before changing anything.

04:00-08:00 · prove connection death

Reconnect only the smallest piece

If Zapier says auth expired, reconnect that app connection and run one test trigger.
If the source is Google/Facebook/Salesforce, check whether scopes or org permissions changed.
Do not rotate unrelated API keys just because the word “auth” appears.

08:00-13:00 · isolate webhook failure

For `401` and replaced webhooks

Verify the exact URL, method, auth header, token location, and sample payload expected by the webhook.
If a new webhook Zap works, keep the old webhook URL and one old payload as evidence. The replay problem is now separate.
Test with a harmless sample. No production secret should be pasted into a public repair note.

13:00-20:00 · build the backfill plan

Repair the missed business, not just the switch

Use Zap history replay if it exists for the failed runs.
If the old webhook cannot replay, export the missing source records and import/send them through a safe one-time path.
Add a canary: one daily count check or alert comparing source events to destination events.

Discharge note

A revived Zap is not “the test run passed.” A revived Zap is: the auth or webhook failure is understood, the missing event window is named, and the backfill path will not duplicate or leak customer data.

Sources I actually checked

Zapier community: “Zapier did not notify us of expired Facebook authentication” — user reported Zapier “failed quietly” while Facebook Lead Ads still had leads.

Zapier community: “401 error when using the retrieve poll Webhook in Zapier” — useful webhook/auth split: missing, invalid, or expired token.

Zapier community: “Refresh Google Access Token to Keep Alive the Connection?” — broken Google auth message around missing access token inside a refresh token response.

Zapier community: “Troubleshooting a failed Webhook Zap and creating a new one” — old webhook failed, new webhook worked, replay/backfill became the real question.

Zapier community: Salesforce expired auth thread — reconnect guidance for an app auth that has expired.

This is intentionally credential-free. If a paid patient sends me secrets, I quarantine them and operate only on redacted artifacts.