# UI extension request signature validation

**URL:** <https://community.hubspot.com/t/ui-extension-request-signature-validation/99016>\
**Category:** APIs & Integrations\
**Tags:** timeline-and-extensions-apis\
**Created:** [January 30, 2024, 5:25pm UTC](https://community.hubspot.com/t/ui-extension-request-signature-validation/99016 "2024-01-30T17:25:49Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Julien\_hublead](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/julien_hublead/32/84013_2.png) [@Julien\_hublead](https://community.hubspot.com/u/Julien_hublead)\
**Post date:** [January 30, 2024, 5:25pm UTC](https://community.hubspot.com/t/ui-extension-request-signature-validation/99016/1 "2024-01-30T17:25:49Z")

</div>

Hello,

I run a public app and I’m having an issue with signature verification for GET requests related to HubSpot UI extensions, I run the v3 algorithm signature check (Same as for webhooks).  
I’ve included the query parameters in the signature construction, the verification is inconsistent.

Could someone clarify if query parameters should indeed be part of the signature verification process? If yes, what is the correct order for incorporating these parameters into the signature?  
Or maybe I don’t use the right verification algo?

Thank you for your guidance!

---

<div class="post-metadata">

**Author:** ![Jaycee\_Lewis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jaycee_lewis/32/61352_2.png) [@Jaycee\_Lewis](https://community.hubspot.com/u/Jaycee_Lewis)\
**Post date:** [February 1, 2024, 11:23pm UTC](https://community.hubspot.com/t/ui-extension-request-signature-validation/99016/2 "2024-02-01T23:23:44Z")

</div>

Hi, [@Julien\_hublead](https://community.hubspot.com/t5/user/viewprofilepage/user-id/542300). Did you make any progress? If not, can share any additional details?

Thank you! — Jaycee

---

<div class="post-metadata">

**Author:** ![Julien\_hublead](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/julien_hublead/32/84013_2.png) [@Julien\_hublead](https://community.hubspot.com/u/Julien_hublead)\
**Post date:** [February 2, 2024, 8:29am UTC](https://community.hubspot.com/t/ui-extension-request-signature-validation/99016/3 "2024-02-02T08:29:46Z")

</div>

Hi [@Jaycee\_Lewis](https://community.hubspot.com/t5/user/viewprofilepage/user-id/127074),  
Thanks for replying!  
Well no I haven’t made any progress on that matter although I suspect that the calls that I cannot sign are coming from users who uninstalled my app  
What more details should I share?