Talk to a human. Reply within minutes.

Rebuild the HMAC using the exact string: `METHOD\nPATH\nBODY\nTIMESTAMP`. Confirm the timestamp is within ±120s of server time, the algorithm header matches (sha256 / sha1 / md5), and you're using the secret — not the public key. Test it live inside the console → API Tester.

The key you're using has an allow-list attached. Open the console → API Keys and either add your server IP / referrer domain, or clear both fields to make the key unrestricted. Changes propagate instantly.

STS credentials are short-lived (15 min default). Call `/api/public/get_sts` again just before uploads, or wire the SDK to refresh automatically when it sees a 403 / ExpiredToken response.

Median response is under 5 minutes during IST business hours. Telegram is the fastest lane — tickets from the site are stamped and pinged to the on-call operator instantly.

Yes. Open API Keys → rotate secret. The new secret is shown once; the old one keeps working for a 60-second grace window so you can redeploy without a hard cut.