Probot 14.0.1 - signature validation fails on projects_v2_item.edited when changing a custom number field

Author: naccynudCreated Aug 5, 2025Updated Aug 7, 2025

Bug Report

Current Behavior I spun up a basic probot v14 application, and listen to project and issue events and output the results to the console. Using smee.io to forward the github webhook to local dev env.

All the issue events work fine, but when I change a custom numeric project data field it throws an error: [@octokit/webhooks] signature does not match event payload and secret

note that custom text fields work fine, seems to just be the numeric custom field.

javascript

// Your code here
(index.js)

import { Probot } from 'probot';

export default (app) => {
  // Handle issue.edited webhook events
  app.on('issues.edited', async (context) => {
    const { payload } = context;
    
    console.log('=== Issue Edited Webhook ===');
    console.log(`Repository: ${payload.repository.full_name}`);
    console.log(`Issue #${payload.issue.number}: ${payload.issue.title}`);
    console.log(`Edited by: ${payload.issue.user.login}`);
    console.log(`Updated at: ${payload.issue.updated_at}`);
    console.log('Full Payload:');
    console.log(JSON.stringify(payload, null, 2));
    console.log('===========================\n');
  });

  // Handle projects_v2_item.edited webhook events
  app.on('projects_v2_item.edited', async (context) => {
    const { payload } = context;
    
    console.log('=== Projects V2 Item Edited Webhook ===');
    console.log(`Repository: ${payload.repository?.full_name || 'Organization Project'}`);
    console.log(`Project Item ID: ${payload.projects_v2_item.id}`);
    console.log(`Content Type: ${payload.projects_v2_item.content_type}`);
    console.log(`Content ID: ${payload.projects_v2_item.content_id}`);
    console.log('Full Payload:');
    console.log(JSON.stringify(payload, null, 2));
    console.log('=====================================\n');
  });
}; 
};


(package.json)

{
  "name": "testghapp",
  "version": "1.0.0",
  "description": "A Probot app that listens for GitHub webhooks and logs them to console",
  "main": "index.js",
  "scripts": {
    "start": "probot run ./index.js",
    "dev": "nodemon --exec \"probot run ./index.js\"",
    "smee": "npx smee --url https://smee.io/your-unique-url --target http://localhost:3000/webhooks"
  },
  "dependencies": {
    "probot": "^14.0.0"
  },
  "devDependencies": {
    "nodemon": "^3.0.0",
    "smee-client": "^4.3.1"
  },
  "engines": {
    "node": ">=18.0.0"
  },
  "keywords": [
    "probot",
    "github",
    "webhooks"
  ],
  "type": "module",
  "author": "",
  "license": "MIT"
}

Here is the webhook payload for the projects_v2_item

javascript


{
  "action": "edited",
  "projects_v2_item": {
    "id": 122845098,
    "node_id": "PVTI_lADODUkZD84A-19WzgdSd6o",
    "project_node_id": "PVT_kwDODUkZD84A-19W",
    "content_node_id": "I_kwDOPS47Yc7EJN-r",
    "content_type": "Issue",
    "creator": {
      "login": "github-project-automation[bot]",
      "id": 113052574,
      "node_id": "BOT_kgDOBr0Lng",
      "avatar_url": "https://avatars.githubusercontent.com/in/235829?v=4",
      "gravatar_id": "",
      "url": "https://api.github.com/users/github-project-automation%5Bbot%5D",
      "html_url": "https://github.com/apps/github-project-automation",
      "followers_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/followers",
      "following_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/following{/other_user}",
      "gists_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/subscriptions",
      "organizations_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/orgs",
      "repos_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/repos",
      "events_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/events{/privacy}",
      "received_events_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/received_events",
      "type": "Bot",
      "user_view_type": "public",
      "site_admin": false
    },
    "created_at": "2025-08-04T20:50:34Z",
    "updated_at": "2025-08-05T15:15:58Z",
    "archived_at": null
  },
  "changes": {
    "field_value": {
      "field_node_id": "PVTF_lADODUkZD84A-19WzgyYtCk",
      "field_type": "number",
      "field_name": "Completed Hours",
      "project_number": 1,
      "from": "6.0",
      "to": 7.0
    }
  },
  "organization": {
    "login": "NaccysOrg",
    "id": 222894351,
    "node_id": "O_kgDODUkZDw",
    "url": "https://api.github.com/orgs/NaccysOrg",
    "repos_url": "https://api.github.com/orgs/NaccysOrg/repos",
    "events_url": "https://api.github.com/orgs/NaccysOrg/events",
    "hooks_url": "https://api.github.com/orgs/NaccysOrg/hooks",
    "issues_url": "https://api.github.com/orgs/NaccysOrg/issues",
    "members_url": "https://api.github.com/orgs/NaccysOrg/members{/member}",
    "public_members_url": "https://api.github.com/orgs/NaccysOrg/public_members{/member}",
    "avatar_url": "https://avatars.githubusercontent.com/u/222894351?v=4",
    "description": null
  },
  "sender": {
    "login": "naccynud",
    "id": 15854541,
    "node_id": "MDQ6VXNlcjE1ODU0NTQx",
    "avatar_url": "https://avatars.githubusercontent.com/u/15854541?v=4",
    "gravatar_id": "",
    "url": "https://api.github.com/users/naccynud",
    "html_url": "https://github.com/naccynud",
    "followers_url": "https://api.github.com/users/naccynud/followers",
    "following_url": "https://api.github.com/users/naccynud/following{/other_user}",
    "gists_url": "https://api.github.com/users/naccynud/gists{/gist_id}",
    "starred_url": "https://api.github.com/users/naccynud/starred{/owner}{/repo}",
    "subscriptions_url": "https://api.github.com/users/naccynud/subscriptions",
    "organizations_url": "https://api.github.com/users/naccynud/orgs",
    "repos_url": "https://api.github.com/users/naccynud/repos",
    "events_url": "https://api.github.com/users/naccynud/events{/privacy}",
    "received_events_url": "https://api.github.com/users/naccynud/received_events",
    "type": "User",
    "user_view_type": "public",
    "site_admin": false
  }
}

Expected behavior/code

I would expect that the event passes signature validation properly.

Environment

Probot version(s): v14.0.1 (replicates in v13 as well)
Node/npm version: Node: 22.15.0 / npm 10.9.2
OS: Windows 10

Possible Solution

Additional context/Screenshots Add any other context about the problem here. If applicable, add screenshots to help explain.

Here is the error message, after one successful text field update

INFO (http): POST /api/github/webhooks 200 - 11ms
INFO (probot): POST http://[::1]:3000/api/github/webhooks - 200
=== Projects V2 Item Edited Webhook ===
Repository: Organization Project
Project Item ID: 122845098
Content Type: Issue
Content ID: undefined
Full Payload:
{
  "action": "edited",
  "projects_v2_item": {
    "id": 122845098,
    "node_id": "PVTI_lADODUkZD84A-19WzgdSd6o",
    "project_node_id": "PVT_kwDODUkZD84A-19W",
    "content_node_id": "I_kwDOPS47Yc7EJN-r",
    "content_type": "Issue",
    "creator": {
      "login": "github-project-automation[bot]",
      "id": 113052574,
      "node_id": "BOT_kgDOBr0Lng",
      "avatar_url": "https://avatars.githubusercontent.com/in/235829?v=4",
      "gravatar_id": "",
      "url": "https://api.github.com/users/github-project-automation%5Bbot%5D",
      "html_url": "https://github.com/apps/github-project-automation",
      "followers_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/followers",
      "following_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/following{/other_user}",
      "gists_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/gists{/gist_id}",
      "starred_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/starred{/owner}{/repo}",
      "subscriptions_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/subscriptions",
      "organizations_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/orgs",
      "repos_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/repos",
      "events_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/events{/privacy}",
      "received_events_url": "https://api.github.com/users/github-project-automation%5Bbot%5D/received_events",
      "type": "Bot",
      "user_view_type": "public",
      "site_admin": false
    },
    "created_at": "2025-08-04T20:50:34Z",
    "updated_at": "2025-08-05T15:15:35Z",
    "archived_at": null
  },
  "changes": {
    "field_value": {
      "field_node_id": "PVTF_lADODUkZD84A-19WzgyvQQk",
      "field_type": "text",
      "field_name": "Text Field",
      "project_number": 1,
      "from": null,
      "to": "hello"
    }
  },
  "organization": {
    "login": "NaccysOrg",
    "id": 222894351,
    "node_id": "O_kgDODUkZDw",
    "url": "https://api.github.com/orgs/NaccysOrg",
    "repos_url": "https://api.github.com/orgs/NaccysOrg/repos",
    "events_url": "https://api.github.com/orgs/NaccysOrg/events",
    "hooks_url": "https://api.github.com/orgs/NaccysOrg/hooks",
    "issues_url": "https://api.github.com/orgs/NaccysOrg/issues",
    "members_url": "https://api.github.com/orgs/NaccysOrg/members{/member}",
    "public_members_url": "https://api.github.com/orgs/NaccysOrg/public_members{/member}",
    "avatar_url": "https://avatars.githubusercontent.com/u/222894351?v=4",
    "description": null
  },
  "sender": {
    "login": "naccynud",
    "id": 15854541,
    "node_id": "MDQ6VXNlcjE1ODU0NTQx",
    "avatar_url": "https://avatars.githubusercontent.com/u/15854541?v=4",
    "gravatar_id": "",
    "url": "https://api.github.com/users/naccynud",
    "html_url": "https://github.com/naccynud",
    "followers_url": "https://api.github.com/users/naccynud/followers",
    "following_url": "https://api.github.com/users/naccynud/following{/other_user}",
    "gists_url": "https://api.github.com/users/naccynud/gists{/gist_id}",
    "starred_url": "https://api.github.com/users/naccynud/starred{/owner}{/repo}",
    "subscriptions_url": "https://api.github.com/users/naccynud/subscriptions",
    "organizations_url": "https://api.github.com/users/naccynud/orgs",
    "repos_url": "https://api.github.com/users/naccynud/repos",
    "events_url": "https://api.github.com/users/naccynud/events{/privacy}",
    "received_events_url": "https://api.github.com/users/naccynud/received_events",
    "type": "User",
    "user_view_type": "public",
    "site_admin": false
  },
  "installation": {
    "id": 77739933,
    "node_id": "MDIzOkludGVncmF0aW9uSW5zdGFsbGF0aW9uNzc3Mzk5MzM="
  }
}
=====================================

INFO (http): POST /api/github/webhooks 200 - 7ms
INFO (probot): POST http://[::1]:3000/api/github/webhooks - 200
ERROR (event): [@octokit/webhooks] signature does not match event payload and secret
    err: {
      "type": "Error",
      "message": "[@octokit/webhooks] signature does not match event payload and secret",
      "stack":
          Error: [@octokit/webhooks] signature does not match event payload and secret
              at verifyAndReceive (file:///C:/Users/dmcintosh/Documents/testghapp/node_modules/@octokit/webhooks/dist-bundle/index.js:524:19)
              at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
              at async processWebhook (file:///C:/Users/dmcintosh/Documents/testghapp/node_modules/@octokit/webhooks/dist-bundle/index.js:666:11)
              at async octokitWebhooksMiddleware (file:///C:/Users/dmcintosh/Documents/testghapp/node_modules/@octokit/webhooks/dist-bundle/index.js:703:14)
              at async Server.<anonymous> (file:///C:/Users/dmcintosh/Documents/testghapp/node_modules/probot/lib/server/server.js:43:25)   
      "event": {
        "id": "1704c5b0-720f-11f0-8551-5c1bb8521cb4",
        "name": "projects_v2_item",
        "payload": "{\"action\":\"edited\",\"projects_v2_item\":{\"id\":122845098,\"node_id\":\"PVTI_lADODUkZD84A-19WzgdSd6o\",\"project_node_id\":\"PVT_kwDODUkZD84A-19W\",\"content_node_id\":\"I_kwDOPS47Yc7EJN-r\",\"content_type\":\"Issue\",\"creator\":{\"login\":\"github-project-automation[bot]\",\"id\":113052574,\"node_id\":\"BOT_kgDOBr0Lng\",\"avatar_url\":\"https://avatars.githubusercontent.com/in/235829?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D\",\"html_url\":\"https://github.com/apps/github-project-automation\",\"followers_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/followers\",\"following_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/subscriptions\",\"organizations_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/orgs\",\"repos_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/repos\",\"events_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/received_events\",\"type\":\"Bot\",\"user_view_type\":\"public\",\"site_admin\":false},\"created_at\":\"2025-08-04T20:50:34Z\",\"updated_at\":\"2025-08-05T15:15:58Z\",\"archived_at\":null},\"changes\":{\"field_value\":{\"field_node_id\":\"PVTF_lADODUkZD84A-19WzgyYtCk\",\"field_type\":\"number\",\"field_name\":\"Completed Hours\",\"project_number\":1,\"from\":\"6.0\",\"to\":7}},\"organization\":{\"login\":\"NaccysOrg\",\"id\":222894351,\"node_id\":\"O_kgDODUkZDw\",\"url\":\"https://api.github.com/orgs/NaccysOrg\",\"repos_url\":\"https://api.github.com/orgs/NaccysOrg/repos\",\"events_url\":\"https://api.github.com/orgs/NaccysOrg/events\",\"hooks_url\":\"https://api.github.com/orgs/NaccysOrg/hooks\",\"issues_url\":\"https://api.github.com/orgs/NaccysOrg/issues\",\"members_url\":\"https://api.github.com/orgs/NaccysOrg/members{/member}\",\"public_members_url\":\"https://api.github.com/orgs/NaccysOrg/public_members{/member}\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/222894351?v=4\",\"description\":null},\"sender\":{\"login\":\"naccynud\",\"id\":15854541,\"node_id\":\"MDQ6VXNlcjE1ODU0NTQx\",\"avatar_url\":\"https://avatars.githubusercontent.com/u/15854541?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/naccynud\",\"html_url\":\"https://github.com/naccynud\",\"followers_url\":\"https://api.github.com/users/naccynud/followers\",\"following_url\":\"https://api.github.com/users/naccynud/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/naccynud/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/naccynud/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/naccynud/subscriptions\",\"organizations_url\":\"https://api.github.com/users/naccynud/orgs\",\"repos_url\":\"https://api.github.com/users/naccynud/repos\",\"events_url\":\"https://api.github.com/users/naccynud/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/naccynud/received_events\",\"type\":\"User\",\"user_view_type\":\"public\",\"site_admin\":false}}",
        "signature": "sha256=b908771d1d8890521011d926c821b0644a0d919295b5b82bacb62d8c2741a377"
      },
      "status": 400
    }
ERROR (probot): [@octokit/webhooks] signature does not match event payload and secret
    err: {
      "type": "AggregateError",
      "message": "[@octokit/webhooks] signature does not match event payload and secret",
      "stack":
          AggregateError: [@octokit/webhooks] signature does not match event payload and secret
              at receiverHandle (file:///C:/Users/dmcintosh/Documents/testghapp/node_modules/@octokit/webhooks/dist-bundle/index.js:426:33) 
              at verifyAndReceive (file:///C:/Users/dmcintosh/Documents/testghapp/node_modules/@octokit/webhooks/dist-bundle/index.js:529:31)
              at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
              at async processWebhook (file:///C:/Users/dmcintosh/Documents/testghapp/node_modules/@octokit/webhooks/dist-bundle/index.js:666:11)
              at async octokitWebhooksMiddleware (file:///C:/Users/dmcintosh/Documents/testghapp/node_modules/@octokit/webhooks/dist-bundle/index.js:703:14)
              at async Server.<anonymous> (file:///C:/Users/dmcintosh/Documents/testghapp/node_modules/probot/lib/server/server.js:43:25)   
      "aggregateErrors": [
        {
          "type": "Error",
          "message": "[@octokit/webhooks] signature does not match event payload and secret",
          "stack":
              Error: [@octokit/webhooks] signature does not match event payload and secret
                  at verifyAndReceive (file:///C:/Users/dmcintosh/Documents/testghapp/node_modules/@octokit/webhooks/dist-bundle/index.js:524:19)
                  at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
                  at async processWebhook (file:///C:/Users/dmcintosh/Documents/testghapp/node_modules/@octokit/webhooks/dist-bundle/index.js:666:11)
                  at async octokitWebhooksMiddleware (file:///C:/Users/dmcintosh/Documents/testghapp/node_modules/@octokit/webhooks/dist-bundle/index.js:703:14)
                  at async Server.<anonymous> (file:///C:/Users/dmcintosh/Documents/testghapp/node_modules/probot/lib/server/server.js:43:25)
          "event": {
            "id": "1704c5b0-720f-11f0-8551-5c1bb8521cb4",
            "name": "projects_v2_item",
            "payload": "{\"action\":\"edited\",\"projects_v2_item\":{\"id\":122845098,\"node_id\":\"PVTI_lADODUkZD84A-19WzgdSd6o\",\"project_node_id\":\"PVT_kwDODUkZD84A-19W\",\"content_node_id\":\"I_kwDOPS47Yc7EJN-r\",\"content_type\":\"Issue\",\"creator\":{\"login\":\"github-project-automation[bot]\",\"id\":113052574,\"node_id\":\"BOT_kgDOBr0Lng\",\"avatar_url\":\"https://avatars.githubusercontent.com/in/235829?v=4\",\"gravatar_id\":\"\",\"url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D\",\"html_url\":\"https://github.com/apps/github-project-automation\",\"followers_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/followers\",\"following_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/following{/other_user}\",\"gists_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/gists{/gist_id}\",\"starred_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/starred{/owner}{/repo}\",\"subscriptions_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/subscriptions\",\"organizations_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/orgs\",\"repos_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/repos\",\"events_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/events{/privacy}\",\"received_events_url\":\"https://api.github.com/users/github-project-automation%5Bbot%5D/received_events\",\"type\":\"Bot\",\"user_view_type\":\"public\",\"site_admin\":false},\"created_at\":\"2025-08-04T20:50:34Z\",\"updated_at\":\"2025-08-05T15:15:58Z\",\"archived_at\":null},\"changes\":{\"field_value\":{\"field_node_id\":\"PVTF_lADODUkZD84A-19WzgyYtCk\",\"field_type\":\"number\",\"field_name\":\"Completed Hours\",\"project_number\":1,\"from\":\"6.0\",\"to\":7}},\"organization\":{\"login\":\"NaccysOrg\",\"id\":222894351,\"node_

Source: probot/probot

View original on GitHub View discussion on GitHub