Please forgive me if this has already been noted; I'll share it in case others run into the same thing:
When hashing the API call + query string, some hashing functions return an upper case hash. That apparently fails. I tried calling getMettings by hashing the following:
getMettings + <<my installation's secret>>
I hashed that one one site and got an ALL CAPS hash, and the API call failed. I tried another site and got a lower case hash - the same hex values - and it succeeded.
Johhn