Webhook signature verification failed (Stripe)

Fix it yourself

Follow the repair

1. Copy the signing secret from the endpoint itself. In the Stripe Dashboard, go to Developers, then Webhooks, and open the exact endpoint that is failing. Reveal its signing secret — it starts with whsec_ — and paste that value into your server's environment variables. Do not reuse a secret from another endpoint, a tutorial screenshot, or an older project: every endpoint has its own, and they are not interchangeable.
2. Verify against the raw body, not parsed JSON. The signature covers the request body byte for byte, so Stripe's constructEvent needs the original payload exactly as it arrived. If your framework already turned the body into a JavaScript object before your code runs, those original bytes are gone. In a Next.js App Router route, read the body as text:

   const rawBody = await req.text();
   const signature = req.headers.get("stripe-signature");
   
   const event = stripe.webhooks.constructEvent(
     rawBody,
     signature,
     process.env.STRIPE_WEBHOOK_SECRET
   );

3. Pass the stripe-signature header through untouched. Read the stripe-signature header from the request exactly as it arrived and hand it to the verification call unchanged. Never rebuild it, trim it, or pull it from a parsed copy of the request. Also check that no middleware, auth layer, or logging tool is consuming or rewriting the body before your webhook handler gets it — anything that touches the body first can quietly change it.
4. Keep test and live in separate worlds. A test-mode endpoint only verifies events sent in test mode, and a live endpoint only verifies live ones. The Stripe CLI adds a third world: when you run stripe listen, it creates a temporary endpoint and prints its own signing secret in your terminal, which matches only CLI-forwarded events. If webhooks fail locally but work live — or the reverse — crossed secrets are the cause almost every time. Give each environment its own variable and check which one the failing server actually loaded.
5. Never verify against a re-typed body. Taking the parsed object and running JSON.stringify on it does not recreate the original: spacing and key order change, so the bytes differ from what Stripe signed and verification fails even with the right secret. In Express, the equivalent of step 2 is giving this one route the raw parser before any JSON parser is registered:

   // Express: raw body for the webhook route only
   app.post("/webhooks/stripe",
     express.raw({ type: "application/json" }),
     webhookHandler);

6. Retest with a real event and watch for a 200. Trigger a genuine event — stripe trigger payment_intent.succeeded from the CLI, or the test-webhook button on the endpoint's dashboard page — and watch the response. A 200 with no signature error means the fix held end to end. A 400 sends you back to steps 1 and 2: in practice, it is always the secret or the raw body, never the events you chose to listen to.