signatureVerificationFailed (error code 37): Signature verification failed

• iOS: a response failed verification while the SDK was in enforced mode. In any other mode it logs the failure and forwards the response (HTTPClient.swift). In the SDK source, enforced mode is marked unavailable for now (Configuration.swift).
• Android: a SignatureVerificationException becomes SignatureVerificationError (errors.kt). Android numbers it 36, while iOS uses 37.
• A server that does not sign with the key the SDK trusts. The stock SDK trusts only RevenueCat's key.
• A response changed in transit, or a proxy that rewrites it. RevenueCat describes verification as detecting tampered requests (RevenueCat docs).

• In informational mode nothing is thrown, and access is still granted by the entitlements in the response. Log the failure and move on.
• If you build forks with enforcement, do not retry in a loop. Treat repeated failures as a tamper signal or a key mismatch.
• Do not grant access from a response that failed verification when you have turned enforcement on.

// Swift
do {
  let result = try await Purchases.shared.purchase(package: package)
} catch let error as ErrorCode where error == .signatureVerificationFailed {
  // handle signature verification failed
}

// Kotlin
if (error.code == PurchasesErrorCode.SignatureVerificationError) { /* ... */ }

On RevenueDot: RevenueDot signs every 2xx and 3xx response under /v1 and /rcbilling when REVENUEDOT_SIGNING_KEY is set, with Ed25519, and serves the public key at /.well-known/revenuedot-signing-key. The stock SDK cannot trust that key, so it reads every RevenueDot response as FAILED until you disable verification or use a fork built with the key. See Trusted Entitlements.