flippercloud/flipper · error · Flipper::Cloud::MessageVerifier::InvalidSignature

No signatures found with expected version #{@version}

Error message

No signatures found with expected version #{@version}

What it means

Error "No signatures found with expected version #{@version}" thrown in flippercloud/flipper.

Source

Thrown at lib/flipper/cloud/message_verifier.rb:55

      # Public: Verifies the signature header for a given payload.
      #
      # Raises a InvalidSignature in the following cases:
      # - the header does not match the expected format
      # - no signatures found with the expected scheme
      # - no signatures matching the expected signature
      # - a tolerance is provided and the timestamp is not within the
      #   tolerance
      #
      # Returns true otherwise.
      def verify(payload, header, tolerance: nil)
        begin
          timestamp, signatures = get_timestamp_and_signatures(header)
        rescue StandardError
          raise InvalidSignature, "Unable to extract timestamp and signatures from header"
        end

        if signatures.empty?
          raise InvalidSignature, "No signatures found with expected version #{@version}"
        end

        expected_sig = generate(payload, timestamp)
        unless signatures.any? { |s| secure_compare(expected_sig, s) }
          raise InvalidSignature, "No signatures found matching the expected signature for payload"
        end

        if tolerance && timestamp < Time.now - tolerance
          raise InvalidSignature, "Timestamp outside the tolerance zone (#{Time.at(timestamp)})"
        end

        true
      end

      private

      # Extracts the timestamp and the signature(s) with the desired version
      # from the header

View on GitHub (pinned to 1f86de3ec9)

Solutions

1. Configure the verifier with the same version used when the endpoint was created (usually 'v1')
2. Upgrade flipper if the Cloud service sends a newer signature version than your gem supports
3. Check the version option passed to MessageVerifier; it must match the version prefix present in the header

When it happens

Trigger: Thrown at lib/flipper/cloud/message_verifier.rb:55 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of flippercloud/flipper@1f86de3ec9 (2026-08-23). Data as JSON: /api/errors/ede719ff90b4f24c. Report an issue: GitHub.