starred/hoppscotch

Fork 0

mirror of https://github.com/hoppscotch/hoppscotch.git synced 2026-04-26 01:06:00 +03:00

[GH-ISSUE #5702] [bug]: Cannot connect Hoppscotch Desktop App to self-hosted instance (Verification error: Invalid signature) #2216

New issue

Closed

opened 2026-03-16 23:36:08 +03:00 by kerem · 4 comments

kerem commented

2026-03-16 23:36:08 +03:00

Owner

Originally created by @Warathep187 on GitHub (Dec 17, 2025).
Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5702

Originally assigned to: @CuriousCorrelation on GitHub.

Is there an existing issue for this?

I have searched existing issues and this bug hasn't been reported yet

Platform

Desktop App

Browser

Chrome

Operating System

macOS

Bug Description

I’m experiencing an issue when using the Hoppscotch Desktop application to connect to a self-hosted Hoppscotch instance.

Previously, I was able to connect to the same self-hosted instance without any problems. However, recently when I try to add the instance again, it fails.

I have already tried clearing the cache using the Clear Cache button in the desktop app and also completely uninstalling and reinstalling the application, but the issue still persists.

Steps

Open Hoppscotch Desktop app
Click Add an Instance
Enter the URL of my self-hosted Hoppscotch instance (port 3200)

An error message is shown:
Failed to download instance: Verification error: Invalid signature

Deployment Type

Self-hosted (on-prem deployment)

Version

2025.11.2

Originally created by @Warathep187 on GitHub (Dec 17, 2025). Original GitHub issue: https://github.com/hoppscotch/hoppscotch/issues/5702 Originally assigned to: @CuriousCorrelation on GitHub. ### Is there an existing issue for this? - [x] I have searched existing issues and this bug hasn't been reported yet ### Platform Desktop App ### Browser Chrome ### Operating System macOS ### Bug Description I’m experiencing an issue when using the Hoppscotch Desktop application to connect to a self-hosted Hoppscotch instance. Previously, I was able to connect to the same self-hosted instance without any problems. However, recently when I try to add the instance again, it fails. I have already tried clearing the cache using the **Clear Cache** button in the desktop app and also completely uninstalling and reinstalling the application, but the issue still persists. **Steps** 1. Open Hoppscotch Desktop app 2. Click Add an Instance 3. Enter the URL of my self-hosted Hoppscotch instance (port 3200) **An error message is shown:** Failed to download instance: Verification error: Invalid signature ![Image](https://github.com/user-attachments/assets/f5f32dad-d9c2-43e7-afc5-2d7ddad1edb2) ### Deployment Type Self-hosted (on-prem deployment) ### Version 2025.11.2

kerem

2026-03-16 23:36:08 +03:00

closed this issue
added the
bug

need testing
labels

kerem commented

2026-03-16 23:36:24 +03:00

Author

Owner

@CuriousCorrelation commented on GitHub (Dec 17, 2025):

Hi @Warathep187, we have seen something similar before https://github.com/hoppscotch/hoppscotch/discussions/4885 - could you see if the discussion helps with your issue as well. If not, I'll be happy to look further into this one.

@CuriousCorrelation commented on GitHub (Dec 17, 2025): Hi @Warathep187, we have seen something similar before https://github.com/hoppscotch/hoppscotch/discussions/4885 - could you see if the discussion helps with your issue as well. If not, I'll be happy to look further into this one.

kerem commented

2026-03-16 23:36:29 +03:00

Author

Owner

@Warathep187 commented on GitHub (Dec 17, 2025):

Thanks for the suggestion. I’ve checked #4885 and my setup is similar.

I’m also running Hoppscotch in a non–all-in-one deployment on Kubernetes in my homelab server. I followed the solution described in that issue link but it did not resolve the problem in my case.

@Warathep187 commented on GitHub (Dec 17, 2025): Thanks for the suggestion. I’ve checked [#4885](https://github.com/hoppscotch/hoppscotch/discussions/4885) and my setup is similar. I’m also running Hoppscotch in a **non**–all-in-one deployment on Kubernetes in my homelab server. I followed the solution described in that issue [link](https://github.com/hoppscotch/hoppscotch/discussions/4885#discussioncomment-15022512) but it did not resolve the problem in my case.

kerem commented

2026-03-16 23:36:34 +03:00

Author

Owner

@CuriousCorrelation commented on GitHub (Dec 17, 2025):

Hi @Warathep187, thanks for the context. If you have similar setup, the "Invalid signature" error you're seeing is I believe caused by the webapp-server generating ephemeral signing keys on each restart or across replicas. When the desktop app caches a bundle signed with one key, then the server restarts (or a different replica responds) with a new key, signature verification fails.

While the idea behind that is security and preventing version mismatch that could potentially corrupt user data, we actually just merged a feature for this in #5644 that adds signing key persistence. The changes haven't been released yet, but once they are, you'll have a few options to make sure you have consistent keys across the pods, basically:

For single replica with persistent storage:

volumes:
  - webapp-data:/data/webapp-server

The server will auto-persist the signing key to /data/webapp-server/signing.key.

For multiple replicas (or if you can't mount a volume):

environment:
  - WEBAPP_SERVER_SIGNING_SECRET=your-shared-secret-here

This will make sure all replicas derive the same key deterministically.

Alternative env vars (in priority order):

Variable	Format
`WEBAPP_SERVER_SIGNING_KEY`	base64, 64 bytes (full private key)
`WEBAPP_SERVER_SIGNING_SEED`	base64, 32 bytes (derives key)
`WEBAPP_SERVER_SIGNING_SECRET`	any string (SHA256 hashed to seed)

Once the next release drops with #5644, updating should resolve this.

@CuriousCorrelation commented on GitHub (Dec 17, 2025): Hi @Warathep187, thanks for the context. If you have similar setup, the "Invalid signature" error you're seeing is I believe caused by the webapp-server generating ephemeral signing keys on each restart or across replicas. When the desktop app caches a bundle signed with one key, then the server restarts (or a different replica responds) with a new key, signature verification fails. While the idea behind that is security and preventing version mismatch that could potentially corrupt user data, we actually just merged a feature for this in #5644 that adds signing key persistence. The changes haven't been released yet, but once they are, you'll have a few options to make sure you have consistent keys across the pods, basically: For single replica with persistent storage: ```yaml volumes: - webapp-data:/data/webapp-server ``` The server will auto-persist the signing key to `/data/webapp-server/signing.key`. For multiple replicas (or if you can't mount a volume): ```yaml environment: - WEBAPP_SERVER_SIGNING_SECRET=your-shared-secret-here ``` This will make sure all replicas derive the same key deterministically. Alternative env vars (in priority order): | Variable | Format | |----------|--------| | `WEBAPP_SERVER_SIGNING_KEY` | base64, 64 bytes (full private key) | | `WEBAPP_SERVER_SIGNING_SEED` | base64, 32 bytes (derives key) | | `WEBAPP_SERVER_SIGNING_SECRET` | any string (SHA256 hashed to seed) | Once the next release drops with #5644, updating should resolve this.

kerem commented

2026-03-16 23:36:39 +03:00

Author

Owner

@Warathep187 commented on GitHub (Dec 17, 2025):

Okay, I understand the issue now. Thank you very much for the explanation. I’ll look forward to the new release 😀

@Warathep187 commented on GitHub (Dec 17, 2025): Okay, I understand the issue now. Thank you very much for the explanation. I’ll look forward to the new release 😀

kerem referenced this issue

2026-03-17 01:16:18 +03:00

[PR #2216] [MERGED] fix: add environment variables for OAuth2 #3677