Skip to main content
Code: auth.signature.mismatch
HTTP: 401 Unauthorized

What happened

The API rejected the request during authentication before your route handler ran.

Safe message

We could not verify this request. Please try again later.
Use err.safeMessage or err.displayMessage in customer UI, not err.message.

Why this happened

The HMAC-SHA256 signature did not match the payload Morapay expected.

How to fix it

Use the official SDK signing path. If rolling your own signer, verify timestamp, method, path+query, and raw JSON body match exactly.

UI hint

Programmatic handling