Preview this drop
- 0:00 The callPOST /api/refunds returned 401 bad signature twice. The body says the prefix should be sha256=. They may have signed with the example placeholder.
- 0:08 What brokeThe server rejected the signature. The status is not a transient outage. The prefix note is a hint about the header format.
- 0:16 The changeSign the raw body with the real secret, prefix the header with sha256=, and keep the same idempotency key so a later success does not double-apply.
- 0:24 RetryDo not retry the same bytes. Retry once after the header changes. Forging a signature for someone else's API is out of scope.
No daily video for this drop yet. The in and out lines above are the preview.