Skip to content
Error codes · realuptime errors ingest

RU-4015: Inbound release signature missing or wrong

This inbound release webhook was created with a signing secret, so every POST must carry an X-RealUptime-Signature header holding sha256=<hex HMAC-SHA256 of the raw request body>, and this request's header was absent or did not verify. This is RealUptime's own signing secret, not Vercel's native x-vercel-signature header, which this connector does not check.

On the wire

Ships with HTTP status 401, carrying "code": "RU-4015" in the response body alongside the human-readable error message. Existing fields are never replaced by the code: it is additive.

Common causes

  • The webhook was created with signing turned on, but the sender does not sign with RealUptime's secret.
  • The secret was rotated (rotating a token also rotates its secret) and the sender still signs with the old one.

How to fix it

  1. Sign the exact bytes sent, with the secret shown once when the webhook was created or rotated.
  2. If your sender cannot sign an arbitrary secret (Vercel's own webhooks cannot), create the webhook without a signing secret; the token in the URL is still the credential.

Related codes

  • RU-4013: Inbound release webhook token not recognized
  • RU-4014: Inbound release payload not understood

Still stuck?

Ask support and mention RU-4015: the code pins down the exact refusal path, so you skip the diagnostic back-and-forth.