Error Codes
Canonical errors returned by Bluecom Auth during the handshake.
Canonical errors returned by the Bluecom Auth service during the handshake.
| Code | HTTP | Cause | Fix |
|---|---|---|---|
UNKNOWN_PROVIDER | 400 | partnerCode is unknown, inactive, or not of type hmac | Verify provisioning with Bluecom ops. Check that you're using the right environment's partnerCode. |
VERIFICATION_FAILED | 401 | HMAC mismatch, expired timestamp, wrong secret, or malformed canonical string | Recompute the token. Check clock skew via NTP. Verify the secret matches the environment. |
Debugging checklist
Work through this list top-to-bottom before escalating to Bluecom ops.
- Is
timestampin seconds, not milliseconds? - Is the signed string exactly
userId:timestamp— no spaces, no JSON? - Is the token lowercase hex?
- Is
partnerSecretfrom the correct environment (staging vs production)? - Is server time within ±5 minutes of UTC?
Clock skew
Most VERIFICATION_FAILED errors in production come from server clocks drifting more than 5 minutes. Ensure your server syncs via NTP.