Keep the lesson for the next incident
Document verification order
Record request body ownership, middleware order, header parsing, secret selection, timestamp tolerance, comparison method, and reject disposition. Define what can be logged safely and who owns endpoint or proxy changes.
Keep byte-level fixtures
Retain exact, altered, reserialized, stale, wrong-secret, missing-header, and encoding cases with synthetic data. Store expected verifier result and final processing state. Include the original mutation shape for future framework upgrades.
Review trust signals
Watch verification failures by endpoint and middleware revision, stale timestamps, missing headers, and any processing before verification. Assign an owner and threshold. Close the follow-up only when every supported receiver path uses the documented raw-body contract.
What to carry forward
Close learning with byte-order rules, fixtures, secret ownership, and trust-boundary signals. Keep proxy and external timing limits visible. The useful outcome is a reproducible reject or accept decision, not a relaxed verifier. Review every middleware change at this boundary during future framework updates.
Technical background: Coinbase developer documentation.
Keep the decision with the work.
Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.
Create an account See the product workflow