Fresh AMO API credentials return HTTP 401: Error decoding signature

Add-ons addons.mozilla.org
1

Hello, I am setting up automatic Firefox submissions from GitHub Actions for StudentDesk AIUB.

Add-on: Client Challenge
Repository: GitHub - amitsami/studentdesk-aiub: StudentDesk AIUB: fast, modern app-style UI for the AIUB Student Portal (phone + PC) · GitHub

Fresh credentials generated on the AMO Manage API Keys page return HTTP 401 with {“detail”:“Error decoding signature.”}. Revoking and regenerating credentials has not resolved it.

Tests performed:

  • Used web-ext 10.7.0 own JwtApiAuth implementation, with HS256 signing and the Authorization: JWT header.
  • Requested the existing add-on versions endpoint with filter=all_with_unlisted.
  • Refreshed the credentials page before testing to avoid stale values.
  • Compared the test machine clock to the Mozilla HTTP Date header; they matched.
  • The same failure occurred in the GitHub Actions credentials check.

The Developer Hub browser submission worked, and v3.9.7 is now publicly available. The problem is API authentication, not the extension upload or review.

Could you advise how to diagnose this, or whether there is an account-side/API issue to check? No API keys, secrets, passwords, or JWT tokens are included in this report.