Written for the failure you are actually looking at, not the happy path the gateway documented. Every worked example is computed by the same code behind the tools, so the output on the page is what the tool would give you.
Checkout, payment links and subscriptions are keyed with your API secret. Webhooks are keyed with the webhook secret. Mixing them up is the most common cause of a signature that will never match.
Four causes account for nearly every INVALID_WEBHOOK_SIGNATURE: a re-serialised body, middleware ordering, a rotated secret on a retried event, and comparing the wrong encoding.
ISO 8583 has no delimiters, so a single wrong length silently misaligns every field that follows. The fix is finding the first field that is wrong, not the first field that looks wrong.
UPI apps disagree about how strictly to parse a upi://pay URI. A literal space, a raw plus or an unescaped ampersand is tolerated by some and truncates the link in others.