Skip to main content
Question

Webhooks Invlid Signature

  • Jun 18, 2026 11:46 PM UTC
  • 3 replies
  • 73 views
Forum|alt.badge.img+4

When Strava post to my webhook endpoint, I’m getting the following error: `strava_webhook.invalid_signature`.
I tried to fix it creating a new subscription to the webhooks, but it keeps failing. I found another post telling something about the Shared signing secret, but not sure if that issue is still happening and if is the same reason to get the invalid signature message.

 

Does anyone have any clue about this issue? Thanks!

3 replies

Forum|alt.badge.img+10
  • Cyril
  • Hub Explorer
  • Jun 19, 2026 10:09 AM UTC

See answer here https://communityhub.strava.com/topic/show?tid=13220&fid=7

    Forum|alt.badge.img+4
    • slowrunner-99
    • Author
    • Hub Rookie
    • Jun 19, 2026 1:16 PM UTC

    See answer here https://communityhub.strava.com/topic/show?tid=13220&fid=7

    Hey Cyril! I saw the answer, but that doesn’t fix anything. I mean, my old integration (without the signature) is not working, but that answer says that the signature is not working right now. So, do I have to assume that the webhooks are broken until Strava announces something?

    Forum|alt.badge.img+10
    • Cyril
    • Hub Explorer
    • Jun 19, 2026 2:49 PM UTC

    Hey ​@slowrunner-99, webhooks are working fine, your code just needs to ignore the signatures until they are formally announced/supported by the Strava API.

    There is currently no way to authenticate incoming webhooks.

    For now I’d suggest simply using an IP whitelist for your incoming webhooks. See the list here: https://communityhub.strava.com/developers-api-7/whitelist-ip-address-webhook-1840?postid=20447#post20447. The list is old but I haven’t seen any problems so far.

      Terms & ConditionsAccessibility statement