App Proxy Invalid signature

Retired Boards Appdev Authentication

Topic summary

Starting July 7, 2023, random “Invalid signature” errors began appearing when validating app proxy signatures using Shopify’s documented method. Prior to this date, no such errors occurred.

Key Details:

  • The incoming signature differs from the expected signature by only the last character
  • Example case:
    • Expected: …d318
    • Received: …d319

Status: The root cause of these validation failures remains unknown. The issue appears to have started suddenly without any apparent changes on the developer’s end.

Summarized with AI on November 18. AI used: claude-sonnet-4-5-20250929.
1

Starting on July 7, 2023, we began observing random “Invalid signature” errors when validating app proxy signatures using the method described in the following documentation:

https://shopify.dev/docs/apps/online-store/app-proxies#calculate-a-digital-signature

In these cases, the incoming signature differed from the expected signature only by the last character. For example:
Expected: …d318
Received: …d319

Prior to July 7, 2023, these errors did not occur. What could be causing this?

1 Like