Skip to documentation content
HintadataDocs

Invalid Signature

The webhook could not be accepted as an authentic, fresh event.

In this guide
  1. 1The webhook could not be accepted as an authentic, fresh event.
In this guide
  1. 1The webhook could not be accepted as an authentic, fresh event.

Invalid Signature

invalid_signaturewebhook
Retry: Not before correction

What happened

The webhook could not be accepted as an authentic, fresh event.

Possible causes

  • The signature was calculated from different raw bytes.conditional
  • The timestamp or event identity is outside the accepted replay policy.conditional

Check in this order

  1. Verify the response evidenceread-only

    Verify the raw body, signature header, timestamp tolerance, and event identity before parsing or mutating state.

    error.code · HTTP status · request_id · X-Trace-Id

Safe recovery

Correct the cause before retryingmutation

Reject invalid or replayed events. Correct raw-body handling or clock skew before accepting a later delivery.

Retry: Not before correction

Success evidence

  • A new response satisfies the documented success contract.

Stop condition

Do not retry until the diagnostic check identifies a corrected input or configuration.

Verification evidence

Contractverifiedcontract-derivedSynthetic recoverynot-applicablecontract-derivedRead-only staging canarynot-applicablecontract-derivedProduction observationno-evidencecontract-derived
Was this page helpful?