Invalid CRC token or json response format

[matthewberryman]

I’m trying to get register an account_activity webhook for receiving messages for app ID 13582352 running code https://github.com/matthewberryman/midsomerplots with the webhook code based very closely on the official boilerplate code https://github.com/twitterdev/twitter-webhook-boilerplate-node with really the only change to the webhook get function being to rewrite it as an AWS Lambda function, however using twurl to register it returns {"errors":[{"code":214,"message":"Webhook URL does not meet the requirements. Invalid CRC token or json response format."}]}. I’ve successfully used the same block of code on another project to get a webhook verified. I’ve triple checked DM permissions for the app, then regenerated tokens (just in case) and made sure the app has those correctly. I’ve logged the incoming crc_token sent by Twitter plus the json I passed back to twitter, and compared that with running the example python2 code at https://developer.twitter.com/en/docs/accounts-and-users/subscribe-account-activity/guides/securing-webhooks to check the generated json incl sha256 hash and it’s identical. The content-type header is set to application/json, and running it in curl the response from my webhook it looks Ok. I’ve checked the latency and it’s less than 1s (and if twitter was seeing higher that generates a different error anyway).

[joncipriano]

Hi @matthewberryman, one issue I had overlooked myself when using AWS/lambda was to make sure to use a secure “https” version of your gateway URL. Shot in the dark, but maybe that’s it.

[matthewberryman]

Thanks for the suggestion but I am passing in (via twurl) the secure https version of the API gateway URL. I’m really at a loss and not sure on next steps as it feels like something’s awry Twitter end—I’ve triple checked everything in every possible way, and as I mentioned I had this same bit of code working on another bot

[matthewberryman]

Ok I’ve deployed the boilerplate code to heroku and that also fails to register with the same error. I’ve double checked the CONSUMER_SECRET is set correctly, and also cross referenced with my app by passing in the same crc_token to both (via curl) and I get back the same response incl. the sha256 string being identical. So I really think this is a problem with my account.

[matthewberryman]

Problem solved. Because I’d already used twurl to set up another bot on another bot, even though I’d run twurl authorize using credentials for this new bot, it still used the other oauth tokens (clue was in ~/.twurlrc having a default profile). Changing profile worked.

[andypiper]