Invalid webhook signatures
- Verify that you are reading the RAW body before any parser/middleware.
- Recompute the HMAC and compare in constant time.
- See the HMAC Signature Verification guide for complete examples.
401/403 on API
- Expired token or insufficient scope.
- Server clock out of sync (use NTP).
Webhooks not arriving
- Endpoint not reachable or too slow → check timeouts and retry settings.
- IP filter/firewall blocking Omniloy’s IPs.
Templates rejected
- Variables out of order or with empty content.
- Text outside Meta’s content policies.