I’m adding this post just for a future reference for anyone looking for a solution for “Invalid signature” error message after migrating to the new SDK JWT auth.
If you’re sure you’re using new SDK app type, your JWT contains right payload, and it’s signed using right SDK key, but still you’re getting “Invalid signature” error, give it a try.
In my case, the reason was iat payload attribute, which stands for “issued at”. According to the documentation, this value should have UTC timestamp. In addition, in the sample app this value was then decreased by some seconds (like 30 or so). This is not enough, as API seems to reject JWT tokens issued at a time which differs too much from a Zoom server time. Probably in my case the difference was like 2 minutes or so comparing to the server time on Zoom side.
Decreasing current timestamp by some higher value like 120 seconds, solves clock difference issue between Zoom server and our servers.
I highly recommend to allow some higher margin on Zoom API side.
For now, what we - developers - can do is to decrease the iat by some reasonable value - it costs us nothing but we’re sure that time difference won’t cause signature issue.
Hope that solves your issue and saves days of troubleshooting (2 days in my case).
Update: yesterday, with a stable connection, I started getting “Invalid signatures” randomly. There were no changes in the code, it just stopped working suddenly. I decreased iat even more from 120 to 400 and that solved the issue again. I guess that’s because traffic going through loadbalancer and being redirected to different servers with slightly different time on board. Don’t have other explanation why it was random and decreasing iat helped immediately.