Errors / invalid_signature

Invalid signature

HTTP 403authenticationinvalid_signature

A callback arrived whose signature did not verify.

What to do

You will see this only if you are posting to our webhook endpoints. The response says nothing about what was wrong with the signature, deliberately — an attacker probing the endpoint learns from every distinction we draw.

What it looks like

{
  "error": {
    "type": "authentication",
    "code": "invalid_signature",
    "message": "…",
    "doc_url": "https://docs.textmast.com/errors/invalid_signature",
    "request_id": "req_01j8xk2p7n4qc3m9v0wz5bt6ay"
  }
}