the signature against the decoded payload

Not specified by the original author.

TL;DR

When you verify BigCommerce signed payloads, base64-decode the payload first and run HMAC-SHA256 over the decoded JSON with your client secret. Verifying against the still-encoded string never matches.

Steps

1. When you verify BigCommerce signed payloads, base64-decode the payload first and run HMAC-SHA256 over the decoded JSON with your client secret. Verifying against the still-encoded string never matches. Compare the hex digests in constant time, and treat any mismatch as a forged request.

When to use

You are seeing this: Verifying against the still-encoded string never matches. Use this skill when you run into "BigCommerce app callbacks: verify the signature against the decoded payload".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Source: Stack Overflow #24463410 (accepted answer, 4 votes): the asker's load callback signature verification never matched. The accepted answer found the docs sample code flawed: it hashes the raw base64-encoded JSON, but the signature BigCommerce sends is a hash of the base64-decoded JSON. Hashing the decoded payload with the client secret verifies correctly.

Verified resolution: When you verify BigCommerce signed payloads, base64-decode the payload first and run HMAC-SHA256 over the decoded JSON with your client secret. Verifying against the still-encoded string never matches. Compare the hex digests in constant time, and treat any mismatch as a forged request.

Source URL: https://stackoverflow.com/questions/24463410/bigcommerce-fail-to-verify-the-load-callbacks

Not specified by the original author.

TL;DR

What fixed it The signature must be verified against the raw request body bytes, not the parsed JSON object.

Steps

1. What was going on

Verifying a Telnyx webhook signature in Express with telnyx-node 1.17.0 fails: telnyx.webhooks.constructEvent(rawBody, signatureHeader, timestampHeader, publicKey) throws 'Signature is invalid and does not match the payload'. The handler needs both the parsed JSON body and the raw body. The raw body is captured via body-parser's verify option.

2. What fixed it

The signature must be verified against the raw request body bytes, not the parsed JSON object. Capture the raw buffer with body-parser's verify option:

app.use(bodyParser.json({ verify(req, res, buffer) { req.rawBody = buffer; } }));

3. then pass req.rawBody (the Buffer) to telnyx.webhooks.constructEvent(req.rawBody, req.header('telnyx-signature-ed25519'), req.header('telnyx-timestamp'), TELNYX_PUBLIC_KEY). The reporter confirmed verification passes with the raw body.

When to use

You are seeing this: What was going on Verifying a Telnyx webhook signature in Express with telnyx-node 1.17.0 fails: telnyx.webhooks.constructEvent(rawBody, signatureHeader, timestampHeader, publicKey) throws 'Signature is invalid and does not match the payload'. Use this skill when you run into "Telnyx webhook 'Signature is invalid and does not match the payload' (Node)".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

Versions mentioned in the source: telnyx-node 1.17.0. If you are on something much newer or older, the details may have shifted.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

In the thread, the question was: Verifying a Telnyx webhook signature in Express with telnyx-node 1.17.0 fails: telnyx.webhooks.constructEvent(rawBody, signatureHeader, timestampHeader, publicKey) throws 'Signature is invalid and does not match the payload'. The handler needs both the parsed JSON body and the raw body. The raw body is captured via body-parser's verify option. The verified resolution: The signature must be verified against the raw request body bytes, not the parsed JSON object. Capture the raw buffer with body-parser's verify option:

app.use(bodyParser.json({ verify(req, res, buffer) { req.rawBody = buffer; } }));

then pass req.rawBody (the Buffer) to telnyx.webhooks.constructEvent(req.rawBody, req.header('telnyx-signature-ed25519'), req.header('telnyx-timestamp'), TELNYX_PUBLIC_KEY). The reporter confirmed verification passes with the raw body. Thread: https://vectle.com/threads/thr_StIjVpt-sFoSHdy4sGweVQ

Not specified by the original author.

Fix Weblate webhook push failing on invalid signature

TL;DR

The signature does not match because the secret differs or the body was modified in transit, so compare secrets and verify against the raw body. Weblate signs the exact bytes it received, so any proxy that rewrites the body breaks the check. Use the raw request body with the configured secret to verify.

The error

Webhook rejected: signature invalid
POST from the git host to the Weblate hook URL returns 400

Fix it

Step 1: Confirm the secret matches on both sides

node -e "console.log('compare the webhook secret in the git host settings with the one in the Weblate component settings, character by character')"

Expected: The secrets are identical.

Step 2: Verify the signature against the raw body

node -e "const c=require('crypto'); const sig=c.createHmac('sha256',process.env.WEBLATE_SECRET).update(process.argv[1]).digest('hex'); console.log(sig)" '{"test":1}'

Expected: You can reproduce the expected signature from the raw bytes.

Step 3: Check for proxies rewriting the body

node -e "console.log('log content-length and a body hash at the edge and at Weblate, they must match')"

Expected: No middleware modifies the body.

Step 4: Redeliver the webhook

node -e "console.log('use the git host recent-deliveries page to redeliver one event')"

Expected: The redelivery returns 200.

When to use this

• Weblate rejects webhooks with invalid signature
• Pushes do not trigger translation updates

When NOT to use this

• The webhook never arrives, check the URL and network
• The signature passes but nothing updates, check the component repo URL

Tool and version compatibility

• Weblate 4.x/5.x webhook receiver
• GitHub, GitLab, and Bitbucket webhook signing

Variant phrasings

signature worked then stopped

Someone rotated the secret on one side. Update both sides together.

invalid only for large pushes

A proxy truncates or re-encodes big bodies. Bypass the proxy for the hook URL.

Why it happens

The signature is an HMAC of the raw request body with the shared secret. A different secret, or any byte-level change to the body by a proxy, firewall, or JSON re-serializer, produces a different HMAC and Weblate rejects it.

Edge cases

• Secrets in URLs get logged, use the header-based signature not a query param
• Clock skew does not matter for HMAC, only the body and secret do
• Test with the provider's redeliver button, hand-crafted curl often gets the body wrong

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_qT1hXcAWgFBz0DtDKcOyYA

Resolved from the public thread: https://vectle.com/posts/pst_qT1hXcAWgFBz0DtDKcOyYA

Thread query: weblate webhook push failed signature invalid

TL;DR: The signature does not match because the secret differs or the body was modified in transit, so compare secrets and verify against the raw body. Weblate signs the exact bytes it received, so any proxy that rewrites the body breaks the check. Use the raw request body with the configured secret to verify.