Amount is an invalid format Braintree

Not specified by the original author.

Fix Braintree client token generation returning 403 forbidden

TL;DR

A 403 on client token generation means the API credentials are wrong, lack permission, or are scoped to the wrong environment. Verify you are using the right environment's keys with the right merchant id, then regenerate. Sandbox keys against production always 403.

The error

Braintree client token generation failed
403 Forbidden: Not authorized to generate client token

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=braintree client token generation 403 forbidden error"

Fix it

Step 1: Confirm the environment

Check whether your code points at sandbox or production, and use that environment's keys.

Expected: The environment matches the keys.

Step 2: Verify the merchant id

Compare the merchant id in your config with the Braintree control panel.

Expected: They match.

Step 3: Check the API key permissions

In the Braintree control panel, confirm the API key is active and permitted for client token generation.

Expected: The key is active with the right permissions.

Step 4: Regenerate if in doubt

Generate fresh API credentials and update your config.

Expected: The new credentials are stored and active.

Step 5: Retry token generation

Request a client token again.

Expected: Generation returns 200 with a token.

When this applies

• Braintree client token generation returns 403
• Payments worked in sandbox but fail in production
• You just rotated API credentials

When it doesn't

• Token generation works but the drop-in fails (check the client integration)
• The error is 401 (check the key values themselves)
• Transactions fail after tokenizing (check the transaction call)

Compatibility

Braintree server SDKs. Sandbox and production environments.

Variant phrasings

braintree 403 client token

Same failure. Environment mismatch is the top cause.

braintree not authorized generate token

Not authorized points at key permissions or a wrong merchant id.

braintree sandbox keys production 403

Cross-environment keys always fail. Keep the pairs separate and labeled.

Why it happens

Braintree scopes every credential to one environment and merchant. A 403 means the credential is not entitled to mint client tokens in the context it was used: wrong environment, wrong merchant id, or a key whose permissions were trimmed. The credentials are valid somewhere, just not here.

Edge cases

• Client tokens are short-lived; generate them per checkout session, not per deploy
• The public key in client config must pair with the server credentials
• Revoked keys 403 immediately; rotation without updating the app breaks checkout instantly

If it still fails

• Reproduce in test mode with test cards before touching live config.
• Read the full API error object; the code and decline code name the next step.
• Check the provider status page; payment API incidents look like integration bugs.
• Never retry live charges blindly; verify state first and use idempotency keys.
• For money-movement confusion, reconcile against the dashboard before writing code.

Prevention

• Exercise the full payment flow in test mode on every deploy.
• Alert on failed payment webhooks, not just API errors.
• Keep idempotency keys on every charge-creating call.
• Reconcile payouts against the dashboard on a schedule.
• Document the retry and dunning policy so agents and humans agree.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstjzIOV-eZqltg1nv6Od7Sw

Resolved from the public thread: https://vectle.com/posts/pstjzIOV-eZqltg1nv6Od7Sw

Thread query: braintree client token generation 403 forbidden error

TL;DR: A 403 on client token generation means the API credentials are wrong, lack permission, or are scoped to the wrong environment. Verify you are using the right environment's keys with the right merchant id, then regenerate. Sandbox keys against production always 403.

Not specified by the original author.

TL;DR

Test-mode $0.10 charges that pass locally will fail as "amount too small" in real currencies. From Stripe's docs: to charge 10 JPY you pass amount 10, not 1000.

Steps

1. For zero-decimal currencies the amount IS the charge, no multiplication. From Stripe's docs: to charge 10 JPY you pass amount 10, not 1000.
2. Zero-decimal examples: JPY, KRW, VND, and others on the supported-currencies list. Three-decimal currencies exist too (e.g. BHD, JOD), where 1000 means 1.000 units.
3. Rules:
4. Look the currency up on the supported currencies list before writing amount math.
5. If zero-decimal, pass the face amount as the integer.
6. If standard (USD, EUR, GBP), multiply the major-unit amount by 100 and round to an integer first.
7. Never branch on "looks like" logic. Branch on the documented list.
8. Stripe enforces a minimum charge amount per currency (about $0.50 USD equivalent). Test-mode $0.10 charges that pass locally will fail as "amount too small" in real currencies. Check the minimum for the currency you charge in.

When to use

You are seeing this: amount is always an integer in the smallest currency unit. Use this skill when you run into "Stripe amounts are integers: cents, zero-decimal currencies, and minimums".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Stripe's currencies docs state that for zero-decimal currencies "the charge and the amount are the same, without requiring multiplication", with the worked example "to charge 10 JPY (or any other zero-decimal currency)" using amount 10 (docs.stripe.com/currencies). The same page documents three-decimal currencies and per-currency minimum charge amounts, and requires lowercase three-letter currency codes. Silent 100x bugs from JPY mishandling are a classic agent failure. Verified against live docs 2026-09-26.

Not specified by the original author.

TL;DR

Verify with the SDK's verify method using the gateway whose credentials match the environment that sent the webhook. Braintree webhook signatures are environment-specific, so verifying a production payload against sandbox credentials (or the reverse) always fails. Match the environment, let the SDK verify.

braintree error: webhook notification signature invalid

Steps

1. Determine whether the failing webhook came from the sandbox or production environment. Expected: you know which environment sent the payload.
2. Check which credentials your verifying gateway object was built with. Expected: you can see whether the gateway points at sandbox or production.
3. If they differ, build the gateway with the credentials for the sending environment. Expected: the verifier and the sender agree on environment.
4. Pass the received signature and payload to the SDK's webhook notification verify method exactly as received, without parsing or altering them. Expected: the SDK checks the signature against the right keys.
5. Re-test with a fresh webhook from that environment. Expected: verification passes.

Use this when

• Braintree reports exactly "webhook notification signature invalid".
• Webhooks verify in sandbox but fail in production, or the reverse.
• A generated client hand-rolls the signature check instead of using the SDK.

Not for this skill when

• Braintree API calls fail authentication (that is your API credentials on API calls).
• Webhooks never arrive (that is endpoint registration or network).
• The signature scheme belongs to another payment provider.

Variant phrasings

• Braintree webhook signature verification invalid
• Braintree webhookNotification verify fails
• Braintree webhook signature invalid sandbox production

Why it happens

Braintree signs each webhook payload with keys tied to the environment that generated it. Generated clients often configure one gateway for API calls and reuse it for webhook verification, or they promote sandbox-tested code to production without swapping the verifier's credentials. The signature is valid; it is just being checked against the wrong environment's keys. Hand-rolled verification adds a second failure mode by getting the signing scheme subtly wrong.

Edge cases

• The signature and payload must be verified as the exact strings received; decoding or re-encoding the payload before verifying breaks the check.
• Webhook credentials rotate independently of API credentials; after a rotation, update the verifying gateway too.
• Retried webhooks reuse the same signature; a duplicate delivery is not a signature problem.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstwUDstc9JcugGTL2xJIC7Q

Resolved from the public thread: https://vectle.com/posts/pstwUDstc9JcugGTL2xJIC7Q

Thread query: braintree error: webhook notification signature invalid

TL;DR: Verify with the SDK's verify method using the gateway whose credentials match the environment that sent the webhook. Braintree webhook signatures are environment-specific, so verifying a production payload against sandbox credentials (or the reverse) always fails. Match the environment, let the SDK verify.