> For the complete documentation index, see [llms.txt](https://docs.tryterra.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tryterra.co/faq/help-topics/webhook/security-signatures-and-network-access/signature-verification-secret-mismatch.md).

# Why does my webhook signature verification fail?

Signature failures almost always mean the signing secret used for verification does not match the one Terra signed with, not a change on Terra's side.

Each environment and each webhook has its own secret, so using a production secret in staging (or vice versa) yields `no matching signature`. A common pattern: multiple `dev_id`s (production, staging, testing) each have their own secret but all point at the same destination URL, so a verifier holding one secret rejects events signed by the others.

To fix it:

{% stepper %}
{% step %}
**Find the correct secret in the dashboard**: open the three-dots menu on the [webhook](https://docs.tryterra.co/health-and-fitness-api/integration-setup/setting-up-data-destinations/webhooks), then Edit.
{% endstep %}

{% step %}
Either give each `dev_id` its own webhook URL/destination, or disable destinations on unused environments.
{% endstep %}

{% step %}
Upgrade to the latest SDK, which deprecates the legacy `secret_key` flow.
{% endstep %}
{% endstepper %}