Troubleshooting

Issue	Solution
Signature mismatch	Ensure you're using the raw request body exactly as received (no parsing/reformatting JSON)
Base64 decode fails	Make sure you're using Base64 URL-safe decoding (not standard Base64). URL-safe uses `-` and `_` instead of `+` and `/`
Empty signature	Contact support to verify your webhook secret is configured for your institution
Timestamp too old	Check that your server clock is synchronized (use NTP)
Encoding issues	Ensure you're reading the body as UTF-8