# Invalid signature after changing app key

**URL:** <https://devforum.zoom.us/t/invalid-signature-after-changing-app-key/31099>\
**Category:** Web\
**Created:** [September 23, 2020, 3:18pm UTC](https://devforum.zoom.us/t/invalid-signature-after-changing-app-key/31099 "2020-09-23T15:18:50Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![lance](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@lance](https://devforum.zoom.us/u/lance)\
**Post date:** [September 23, 2020, 3:18pm UTC](https://devforum.zoom.us/t/invalid-signature-after-changing-app-key/31099/1 "2020-09-23T15:18:50Z")

</div>

**Description**  
Testing goes as expected using a test JWT app key, we change to the client’s JWT app key and cannot join meetings, with error 3712 “Invalid signature”

**Error**  
Object { method: “join”, status: false, result: “Invalid signature.”, errorMessage: “Signature is invalid.”, errorCode: 3712 }

**Which version?**  
1.8.0

**Additional context**  
Using C# sample code for generating the signature, works perfectly with our test signature app, the only change made is the key and secret using the client’s paid account

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [September 24, 2020, 8:35pm UTC](https://devforum.zoom.us/t/invalid-signature-after-changing-app-key/31099/2 "2020-09-24T20:35:15Z")

</div>

Hey @lance,

Can you provide your Web SDK signature for a test meeting to [developersupport@zoom.us](mailto:developersupport@zoom.us) so I can investigate this issue further?

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![lance](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@lance](https://devforum.zoom.us/u/lance)\
**Post date:** [September 25, 2020, 2:44pm UTC](https://devforum.zoom.us/t/invalid-signature-after-changing-app-key/31099/3 "2020-09-25T14:44:32Z")

</div>

[signature redacted]

---

<div class="post-metadata">

**Author:** ![will.zoom](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/will.zoom/32/14417_2.png) [@will.zoom](https://devforum.zoom.us/u/will.zoom)\
**Post date:** [September 28, 2020, 8:04pm UTC](https://devforum.zoom.us/t/invalid-signature-after-changing-app-key/31099/4 "2020-09-28T20:04:31Z")

</div>

Hey @lance,

It looks like your signature is being generated slightly incorrectly:  
 ![image](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/5/b/5bdc38413a17db325df24688fdea301c2c1848c6.png)

Please see the `..` preceding the timestamp.

Can you ensure you’re following these steps correctly:

> **[Generate Signature - Build an App - Web - Native SDKs - Zoom Software...](https://marketplace.zoom.us/docs/sdk/native-sdks/web/build/signature)**
>
> Generate Signature
> 
> Each request to start or join a meeting / webinar must be verified by an encrypted signature authorizing each user to enter. A signa...

Your signature should follow this format:  
`jwtKey.meetingNumber.expiryTime.role.encryptedJwtSecret`

Thanks,  
Will

---

<div class="post-metadata">

**Author:** ![lance](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@lance](https://devforum.zoom.us/u/lance)\
**Post date:** [September 29, 2020, 5:59pm UTC](https://devforum.zoom.us/t/invalid-signature-after-changing-app-key/31099/6 "2020-09-29T17:59:31Z")

</div>

Hey Will thanks for the response, not sure what was going on with that one, this is a new test from today

This is the signature passed to the api

I decoded that from the generated URL here

 ![console](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/4/5/4582042028a23a36957c04eafcffd5d9b341d516.png)

It includes timestamp, meeting ID etc as expected

Something I just thought of, one difference between our test account and live, my account has the flag for password required where here we will not have passwords, I’ve been passing empty string is that correct or should the parameter be omitted entirely?

Again just very curious since the only change here has been the keys, exact same code running

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [October 1, 2020, 8:11pm UTC](https://devforum.zoom.us/t/invalid-signature-after-changing-app-key/31099/7 "2020-10-01T20:11:35Z")

</div>

Hey @lance,

For us to debug this further, can you please share the account # or email of the Zoom account who owns the JWT Token? Please send it to [developersupport@zoom.us](mailto:developersupport@zoom.us) with a link to this thread.

Thanks,  
Tommy

---

<div class="post-metadata">

**Author:** ![lance](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@lance](https://devforum.zoom.us/u/lance)\
**Post date:** [October 1, 2020, 9:29pm UTC](https://devforum.zoom.us/t/invalid-signature-after-changing-app-key/31099/8 "2020-10-01T21:29:15Z")

</div>

> [@tommy](#):
>
> of the Zoom account who owns the JWT Token?

Hi Tommy thanks, getting that to you now

---

<div class="post-metadata">

**Author:** ![tommy](https://sea2.discourse-cdn.com/flex016/user_avatar/devforum.zoom.us/tommy/32/72769_2.png) [@tommy](https://devforum.zoom.us/u/tommy)\
**Post date:** [October 2, 2020, 9:06pm UTC](https://devforum.zoom.us/t/invalid-signature-after-changing-app-key/31099/9 "2020-10-02T21:06:11Z")

</div>

Thanks @lance! 🙂

We will be with you shortly!

-Tommy

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/zoomdeveloper/original/3X/6/1/614bdd549b610bbaa46ff934617683a02bdaa03c.png) [@system](https://devforum.zoom.us/u/system)\
**Post date:** [November 2, 2020, 7:06am UTC](https://devforum.zoom.us/t/invalid-signature-after-changing-app-key/31099/10 "2020-11-02T07:06:28Z")

</div>

Closed on November 2, 2020, 7:06am UTC

This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.
