Establish what is happening
Capture safe delivery metadata
Record endpoint, method, content type, body length, timestamp label, signature header name, environment, and verifier revision. Do not log the secret or full payload. Note whether middleware read, parsed, or reserialized the body before verification.
Compare raw and parsed bytes
Use a synthetic signed delivery and compare original bytes with the bytes passed to the verifier. Check whitespace, key order, encoding, and newline changes. Keep a valid signature with the exact raw body beside the failing representation.
Separate validation failures
Group failures by secret label, timestamp freshness, header, body mutation, proxy, and endpoint. Compare the verifier result with a safe stale-signature and wrong-secret case. Do not bypass verification to see whether downstream processing works.
What to carry forward
Triage ends with one delivery, raw-body path, signature metadata, first mismatch, and evidence gap. Keep the event rejected while authenticity is unknown. Route middleware, secret, timestamp, and endpoint questions separately. The receiver should remain closed to unverified data.
Technical background: Coinbase developer documentation.
Keep the decision with the work.
Use a Work Item in Aglet to record the problem, the evidence you have, and the next decision. Add an owner and priority, then keep updates in the discussion so the next person can follow the reasoning.
Create an account See the product workflow