Tencent/WeKnora · error

invalid verification token

Error message

invalid verification token

What it means

VerifyCallback rejects an incoming Feishu event whose header token does not match the adapter's configured verificationToken. Feishu signs each event/callback with the app's verification token; mismatch means the request did not originate from your Feishu app (or credentials are out of sync).

Source

Thrown at internal/im/feishu/adapter.go:204

	if err := json.Unmarshal(bodyBytes, &encryptedBody); err == nil && encryptedBody.Encrypt != "" {
		decrypted, err := a.decrypt(encryptedBody.Encrypt)
		if err != nil {
			return fmt.Errorf("decrypt event for verification: %w", err)
		}
		raw = decrypted
	} else {
		raw = bodyBytes
	}

	var eventBody struct {
		Header *feishuEventHeader `json:"header"`
	}
	if err := json.Unmarshal(raw, &eventBody); err != nil {
		return fmt.Errorf("unmarshal event header: %w", err)
	}

	if eventBody.Header == nil || eventBody.Header.Token != a.verificationToken {
		return fmt.Errorf("invalid verification token")
	}

	return nil
}

// HandleURLVerification handles the Feishu URL verification challenge.
func (a *Adapter) HandleURLVerification(c *gin.Context) bool {
	bodyBytes, err := io.ReadAll(c.Request.Body)
	if err != nil {
		return false
	}
	c.Request.Body = io.NopCloser(bytes.NewReader(bodyBytes))

	// Try to parse as a challenge request
	var body map[string]interface{}

	// If encrypted, try to decrypt first
	var encryptedBody struct {

View on GitHub (pinned to 988cbb0330)

Solutions

1. Copy the current Verification Token from the Feishu developer console (App Credentials) into the adapter's verificationToken config
2. Confirm the callback URL is registered to the same app whose token you configured
3. Reject non-matching requests with 401/403 and check server logs for probing traffic

Example fix

// before
adapter, _ := NewAdapter(ctx, Config{VerificationToken: "old-token"})
// after
adapter, _ := NewAdapter(ctx, Config{VerificationToken: "current-token-from-console"})

// verify the configured token matches the app in the Feishu console at startup

if err := adapter.VerifyCallback(req); err != nil {
    if strings.Contains(err.Error(), "invalid verification token") {
        http.Error(w, "unauthorized", http.StatusUnauthorized)
        return
    }
    http.Error(w, "bad request", http.StatusBadRequest)
}

When it happens

Trigger: An HTTP callback arrives and eventBody.Header is nil, or eventBody.Header.Token differs from the verification token given at NewAdapter time.

Common situations: Callback registered under a different Feishu app than the credentials configured; verification token rotated in the Feishu developer console but not in config; a non-Feishu client probing the webhook endpoint; forwarding events from the wrong environment (test vs production app).

Related errors

• OIDC provider returned no user claims
• id_token missing sub claim
• failed to check bucket: %w
• invalid APPID or APPSECRET (HTTP %d)
• list team repos: %w

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/af98aabaad2f8bfb. Report an issue: GitHub.