[Bug] Cannot connect to agent (Unauthorized)

[baloo2]

What’s the bug?

Cannot connect to agent (Unauthorized / Signature expired)

Description

I have both App and Agent installed on 2 machines in docker containers (on same local network).

When I try to add Agent to App I get the following error:

Error: 401, message='Unauthorized’,
url='http://192.168.5.51:9413/api/public/access’

When I try to reach that url (http://192.168.5.51:9413/api/public/access) I get this:
{"detail":"Signature expired (age=1763640859s)"}

Logs in Agent show this:
AGENT - WARNING - 2025-11-19 17:27:00 - Signature expired (age=1763573220s)

I double checked SECRETS - they are the same on both containers.

Expected behaviour

App should connect to Agent

To reproduce

Create App and Agent in Docker

Platform

Intel

Versions

Tugtainer 1.12.0
Docker 28.3.3

Relevant log output

Extra

No response

[Quenary]

Hi,
it might be because of the secret value, some characters aren't allowed because it's an env variable. Try using only letters and numbers.

When I try to reach that url (http://192.168.5.51:9413/api/public/access) I get this:
{"detail":"Signature expired (age=1763640859s)"}

That is expected because manual request missing signature headers.

[baloo2]

I tried only letters:

environment:
      AGENT_SECRET: hello

With version 1.12.2 I can see host in container list but with error:
424 Failed Dependency - Agent error: 401, message='Unauthorized', url='http://192.168.5.51:9413/api/container/list'

[Quenary]

Could this be related to the container's time zones?

With version 1.12.2 I can see host in container list but with error:
424 Failed Dependency - Agent error: 401, message='Unauthorized', url='http://192.168.5.51:9413/api/container/list'

After receiving this error, try checking the agent logs. If there's an error about the timestamp, that might be the case.

[MrMxyzptlk]

I'm getting the same suddenly on the 3 hosts with agents.

[Quenary]

With the LOG_LEVEL=debug in the agent container, after the error there should be lines like:

Verifying signature headers...
Headers: ...

And after that Signature expired... or Invalid signature for...

Example of error log:

AGENT - DEBUG - 2025-12-01 19:18:56 - Verifying signature headers for:
POST
/api/container/list
{'all': True}
AGENT - DEBUG - 2025-12-01 19:18:56 - Headers: {'host': '127.0.0.1:8001', 'x-tugtainer-timestamp': '1764605936', 'x-tugtainer-signature': 'zHFvtTrxUZe+3H7GW5UkbJrotvC9ClpJFnrJuiz2ARQ=', 'accept': '/', 'accept-encoding': 'gzip, deflate', 'user-agent': 'Python/3.13 aiohttp/3.13.2', 'content-length': '13', 'content-type': 'application/json'}
AGENT - WARNING - 2025-12-01 19:18:56 - Invalid signature for: POST /api/container/list {'all': True}
INFO 127.0.0.1:42742 - "POST /api/container/list HTTP/1.1" 401