diff --git a/tests/test_key_provisioning.py b/tests/test_key_provisioning.py
index 74de2c5..3fcbaf1 100644
--- a/tests/test_key_provisioning.py
+++ b/tests/test_key_provisioning.py
@@ -128,3 +128,9 @@ def test_blank_order_id_returns_400(self, hs):
         _post_subscription(client, "xBridge Founder", "buyer@example.com")
         resp = client.post("/keys/mine", json={"email": "buyer@example.com", "order_id": ""})
         assert resp.status_code == 400
+
+    def test_non_ascii_order_id_returns_404_not_500(self, hs):
+        client = TestClient(hs.app)
+        _post_subscription(client, "xBridge Founder", "buyer@example.com")
+        resp = client.post("/keys/mine", json={"email": "buyer@example.com", "order_id": "ord-é123"})
+        assert resp.status_code == 404
diff --git a/xbridge_mcp/http_server.py b/xbridge_mcp/http_server.py
index 9cd71ca..c8953bd 100644
--- a/xbridge_mcp/http_server.py
+++ b/xbridge_mcp/http_server.py
@@ -254,7 +254,9 @@ async def keys_mine(request: Request):
         return not_found
 
     stored_order_id = str(entry.get("order_id") or "")
-    if not stored_order_id or not hmac.compare_digest(submitted_order_id, stored_order_id):
+    if not stored_order_id or not hmac.compare_digest(
+        submitted_order_id.encode("utf-8"), stored_order_id.encode("utf-8")
+    ):
         return not_found
 
     return JSONResponse({"key": entry["key"], "tier": entry["tier"], "email": email})