flippercloud/flipper · error · Flipper::Cloud::MessageVerifier::InvalidSignature

No signatures found with expected version #

Error message

No signatures found with expected version #{@version}

What it means

Error "No signatures found with expected version #{@version}" thrown in flippercloud/flipper.

Solutions

1. Configure the verifier with the same version used when the endpoint was created (usually 'v1')
2. Upgrade flipper if the Cloud service sends a newer signature version than your gem supports
3. Check the version option passed to MessageVerifier; it must match the version prefix present in the header

When it happens

Trigger: Thrown at lib/flipper/cloud/message_verifier.rb:55 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of flippercloud/flipper@1f86de3ec9 (2026-08-23). Data as JSON: /api/errors/ede719ff90b4f24c. Report an issue: GitHub.

Appendix: source

Thrown at lib/flipper/cloud/message_verifier.rb:55

      # Public: Verifies the signature header for a given payload.
      #
      # Raises a InvalidSignature in the following cases:
      # - the header does not match the expected format
      # - no signatures found with the expected scheme
      # - no signatures matching the expected signature
      # - a tolerance is provided and the timestamp is not within the
      #   tolerance
      #
      # Returns true otherwise.
      def verify(payload, header, tolerance: nil)
        begin
          timestamp, signatures = get_timestamp_and_signatures(header)
        rescue StandardError
          raise InvalidSignature, "Unable to extract timestamp and signatures from header"
        end

        if signatures.empty?
          raise InvalidSignature, "No signatures found with expected version #{@version}"
        end

        expected_sig = generate(payload, timestamp)
        unless signatures.any? { |s| secure_compare(expected_sig, s) }
          raise InvalidSignature, "No signatures found matching the expected signature for payload"
        end

        if tolerance && timestamp < Time.now - tolerance
          raise InvalidSignature, "Timestamp outside the tolerance zone (#{Time.at(timestamp)})"
        end

        true
      end

      private

      # Extracts the timestamp and the signature(s) with the desired version
      # from the header

View on GitHub (pinned to 1f86de3ec9)