I am calling Magento rest API to load all products of a site.


It gives the following error -

 "message": "The signature is invalid. Verify and try again."

I am calling it through a Laravel project. I am not getting any errors while calling a single product or order GET API. I am only getting this error for the APIs that contain query parameters.

I really appreciate any help you can provide.

3 Answers 3


If you call the API from another source of a project, like Laravel, you will definitely get this error as:

  • The signature error occurs with either a malformed URL or rejected Access Token/Token Secret authorized by admin.

Did you try to run it on Postman?

So, first, you need to authorize: Try using a bearer token , set up HTTP client operation header "Content-Type = application/json" , "Authorization = Bearer

To generate a Token, follow this https://devdocs.magento.com/guides/v2.4/get-started/authentication/gs-authentication-token.html

You can also go through this: https://github.com/grayloon/magento-laravel-api

  • But store_url/rest/V1/products/productSku this API is working perfectly. Feb 14 at 11:22
  • Then first try to Run in Postman, if everything works fine means there is an issue an Oath Authentication. Next the solution is to try to run the with token based. Feb 14 at 13:00
  • In postman it is ok. But I have to go with OAuth. Feb 15 at 9:15
  • Let's connect then to see this in detail please connect on Skype: jyotishina.rajwani Feb 16 at 11:53

In assumption this use for dev environment or published resource such as catalog, you can done it without authenticator, try this https://experienceleague.adobe.com/docs/commerce-admin/config/services/magento-web-api.html?lang=en#web-api-security


The error comes from this method in the codebase \Magento\Framework\Oauth\Oauth::_validateSignature

Seems that your generated oauth_signature value in your request headers does not match the oauth_signature_method you've defined in your request headers? A reminder that in Magento version 2.4, Magento only allows for HMAC-SHA256 signatures.

If the above is not the issue, maybe your request is missing some data? Certainly seems to be an issue with authentication regardless. Would definitely be worth having a read of the Magento Oauth devdocs - linked below:

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.