Why a signature is rejected

Nearly every failure is the body changing between signing and sending:

• Letting your HTTP client serialize for you. Helpers that accept an object rather than a string re-encode it, producing different bytes than the ones you signed — for example Python's requests.post(url, json=data). Build the string yourself and pass it as the raw body (data=payload).
• Rebuilding, re-indenting or re-ordering the JSON after computing the signature.
• Wrong signature format — it must be lowercase hex, not uppercase and not Base64.
• Wrong key — see Two different secrets.

Non-ASCII values: PHP escapes non-ASCII characters to \uXXXX by default, while some stacks (for example JavaScript's JSON.stringify) emit raw UTF-8. These produce different bytes and therefore different signatures, so make sure the string you sign is the same string you transmit.