Invalid Signature
invalid_signaturewebhookWhat happened
The webhook could not be accepted as an authentic, fresh event.
Possible causes
- The signature was calculated from different raw bytes.conditional
- The timestamp or event identity is outside the accepted replay policy.conditional
Check in this order
- Verify the response evidenceread-only
Verify the raw body, signature header, timestamp tolerance, and event identity before parsing or mutating state.
error.code · HTTP status · request_id · X-Trace-Id
Safe recovery
Correct the cause before retryingmutation
Reject invalid or replayed events. Correct raw-body handling or clock skew before accepting a later delivery.
Retry: Not before correctionSuccess evidence
- A new response satisfies the documented success contract.
Stop condition
Do not retry until the diagnostic check identifies a corrected input or configuration.
Verification evidence
Contractverifiedcontract-derivedSynthetic recoverynot-applicablecontract-derivedRead-only staging canarynot-applicablecontract-derivedProduction observationno-evidencecontract-derived