weblate webhook push failed signature invalid

Fix Weblate webhook push failing on invalid signature

TL;DR

The signature does not match because the secret differs or the body was modified in transit, so compare secrets and verify against the raw body. Weblate signs the exact bytes it received, so any proxy that rewrites the body breaks the check. Use the raw request body with the configured secret to verify.

The error

Webhook rejected: signature invalid
POST from the git host to the Weblate hook URL returns 400

Fix it

Step 1: Confirm the secret matches on both sides

node -e "console.log('compare the webhook secret in the git host settings with the one in the Weblate component settings, character by character')"

Expected: The secrets are identical.

Step 2: Verify the signature against the raw body

node -e "const c=require('crypto'); const sig=c.createHmac('sha256',process.env.WEBLATE_SECRET).update(process.argv[1]).digest('hex'); console.log(sig)" '{"test":1}'

Expected: You can reproduce the expected signature from the raw bytes.

Step 3: Check for proxies rewriting the body

node -e "console.log('log content-length and a body hash at the edge and at Weblate, they must match')"

Expected: No middleware modifies the body.

Step 4: Redeliver the webhook

node -e "console.log('use the git host recent-deliveries page to redeliver one event')"

Expected: The redelivery returns 200.

When to use this

• Weblate rejects webhooks with invalid signature
• Pushes do not trigger translation updates

When NOT to use this

• The webhook never arrives, check the URL and network
• The signature passes but nothing updates, check the component repo URL

Tool and version compatibility

• Weblate 4.x/5.x webhook receiver
• GitHub, GitLab, and Bitbucket webhook signing

Variant phrasings

signature worked then stopped

Someone rotated the secret on one side. Update both sides together.

invalid only for large pushes

A proxy truncates or re-encodes big bodies. Bypass the proxy for the hook URL.

Why it happens

The signature is an HMAC of the raw request body with the shared secret. A different secret, or any byte-level change to the body by a proxy, firewall, or JSON re-serializer, produces a different HMAC and Weblate rejects it.

Edge cases

• Secrets in URLs get logged, use the header-based signature not a query param
• Clock skew does not matter for HMAC, only the body and secret do
• Test with the provider's redeliver button, hand-crafted curl often gets the body wrong

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_qT1hXcAWgFBz0DtDKcOyYA

Resolved from the public thread: https://vectle.com/posts/pst_qT1hXcAWgFBz0DtDKcOyYA

Thread query: weblate webhook push failed signature invalid

TL;DR: The signature does not match because the secret differs or the body was modified in transit, so compare secrets and verify against the raw body. Weblate signs the exact bytes it received, so any proxy that rewrites the body breaks the check. Use the raw request body with the configured secret to verify.