flippercloud/flipper · error · Flipper::Cloud::MessageVerifier::InvalidSignature

No signatures found matching the expected signature for payl

Error message

No signatures found matching the expected signature for payload

What it means

Error "No signatures found matching the expected signature for payload" thrown in flippercloud/flipper.

Source

Thrown at lib/flipper/cloud/message_verifier.rb:60

      # - no signatures matching the expected signature
      # - a tolerance is provided and the timestamp is not within the
      #   tolerance
      #
      # Returns true otherwise.
      def verify(payload, header, tolerance: nil)
        begin
          timestamp, signatures = get_timestamp_and_signatures(header)
        rescue StandardError
          raise InvalidSignature, "Unable to extract timestamp and signatures from header"
        end

        if signatures.empty?
          raise InvalidSignature, "No signatures found with expected version #{@version}"
        end

        expected_sig = generate(payload, timestamp)
        unless signatures.any? { |s| secure_compare(expected_sig, s) }
          raise InvalidSignature, "No signatures found matching the expected signature for payload"
        end

        if tolerance && timestamp < Time.now - tolerance
          raise InvalidSignature, "Timestamp outside the tolerance zone (#{Time.at(timestamp)})"
        end

        true
      end

      private

      # Extracts the timestamp and the signature(s) with the desired version
      # from the header
      def get_timestamp_and_signatures(header)
        list_items = header.split(/,\s*/).map { |i| i.split("=", 2) }
        timestamp = Integer(list_items.select { |i| i[0] == "t" }[0][1])
        signatures = list_items.select { |i| i[0] == @version }.map { |i| i[1] }
        [Time.at(timestamp), signatures]

View on GitHub (pinned to 1f86de3ec9)

Solutions

1. Confirm the webhook secret matches the one shown in Flipper Cloud for this endpoint; a wrong secret produces non-matching signatures
2. Verify against the raw, unparsed request body; any modification (whitespace, key order) breaks the HMAC
3. Check for middleware that mutates the body before verification (e.g. params parsing, compression)

When it happens

Trigger: Thrown at lib/flipper/cloud/message_verifier.rb:60 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of flippercloud/flipper@1f86de3ec9 (2026-08-23). Data as JSON: /api/errors/914ad751f93571b2. Report an issue: GitHub.