// troubleshooting guide · upstash

QStash Signature Verification Failed (Invalid Signature)

Status
Workaround available
platforms:
QStash (Next.js, Cloudflare Workers, Django, Node.js)
updated:
November 15, 2026
reports:
3
Method
how we research
Share

RUNBOOK · upstash/qstash-invalid-signature4 FIXES

// quick answer

QStash signs every request; verification fails when your handler re-serializes the body, uses the wrong signing keys, or a proxy strips the Upstash-Signature header. Verify the raw body text with the Receiver and both current and next signing keys.

Most likely fix: Verify the raw body

How to fix it

// try these in order, the most common fix is first

  1. FIX 1Verify the raw body

    1. 01Read the body as text (await req.text()) before any parsing
    2. 02Pass that exact string to receiver.verify({ signature, body })
    3. 03Parse JSON only after verification passes
    Did this fix it?
  2. FIX 2Use the right signing keys

    1. 01Upstash Console > QStash > copy Current and Next signing keys
    2. 02Set QSTASH_CURRENT_SIGNING_KEY and QSTASH_NEXT_SIGNING_KEY in the environment
    3. 03Use the SDK Receiver, which checks both keys so rotation doesn't break you
    Did this fix it?
  3. FIX 3Preserve headers through proxies

    1. 01In Nginx, make sure the Upstash-Signature header is passed to the app
    2. 02Check that no middleware rewrites the body (compression, body parsers)
    Did this fix it?
  4. FIX 4Test end to end

    1. 01Publish a test message from the Console's request builder
    2. 02Check the QStash logs tab for the response code and body
    Did this fix it?

Symptoms

Your endpoint returns 401 'Invalid signature' to QStash, messages retry and land in the DLQ, or verifySignature throws in Next.js/Cloudflare Workers.

Why it happens

  • C-01Body parsed as JSON then JSON.stringify'd before verifying
  • C-02Wrong or outdated QSTASH_CURRENT_SIGNING_KEY / QSTASH_NEXT_SIGNING_KEY
  • C-03Reverse proxy (Nginx) drops the Upstash-Signature header
  • C-04URL mismatch between the published destination and the verified URL

// this guide also covers

  • qstash invalid signature
  • qstash signature verification failed
  • upstash qstash 401
  • qstash receiver verify error

Still not working?

If Upstash keeps failing, you're not alone. See every Upstash problem users report or the alternatives people switch to.

Have an app idea? Our small team builds any software: web and mobile apps, games, desktop, AI tools. Price agreed together.

Talk to us

Watch Upstash Get an email when its price changes, it has an outage, or we publish a new fix. No spam.

Fixed it? Share this guide

Other Upstash errors

All 11 Upstash errors and fixes →