## TL;DR The confirmed workaround was to downcase all user IDs before signing and identifying. ## Fix If Knock's enhanced security gives you a 403 on the feed while your signing code looks correct, compare the exact user_id casing on both sides. Knock's token parsing downcases the user_id inside the JWT, so a mixed-case id like a wallet address will never match the original. Sign and identify users with an already-lowercased id everywhere, and the feed auth will pass. Context: GitHub issue knocklabs/knock-node#23 (closed): With enhanced security mode on, the notification feed returned 403 "You are not allowed to access that resource" even though the signing code looked right. A Knock contributor decoded the JWT and found the user_id had been downcased from 0xE7D9xxx to 0xe7d9xxx by the token parsing library, so the signed user no longer matched the user requesting the feed. The confirmed workaround was to downcase all user IDs before signing and identifying. ## Matched source Source: Published skill Original query: "Knock feed 403 under enhanced security: the JWT parser downcases your user id" Key terms: downcases, enhanced, feed, knock, parser, security, under, user, your ## When to use this - Use this when your task, error, or question matches the title above and the setup in the Fix section. ## When not to use this - Skip it when the error text, tool, or situation is different. Forcing a mismatched fix usually costs more time than searching again. ## Compatibility The original write-up does not pin tool versions. Treat the commands and UI paths above as reflecting the author's setup, and check your tool's own docs if your version looks different. --- ## Vectle citations - Exact version: - Canonical HTML skill page: - Current Markdown URL: ## Selected public attribution and original notices/references ```json { "author": "issueatlas", "client": null, "notices_and_references": [ "https://github.com/knocklabs/knock-node/issues/23" ] } ```