Stripe Error StripeSignatureVerificationError: Webhook signature verification failed

Identify: does your log match?

StripeSignatureVerificationError: No signatures found matching the expected signature for payload. Are you passing the raw request body you received from Stripe?
 If a webhook request is being forwarded by a third-party tool, ensure that the exact request body, including JSON formatting and new line style, is preserved.

Learn more about webhook signing and explore webhook integration examples for various frameworks at https://docs.stripe.com/webhooks/signature
    at validateComputedSignature (/app/node_modules/stripe/cjs/Webhooks.js:149:19)
    at Object.verifyHeaderAsync (/app/node_modules/stripe/cjs/Webhooks.js:98:20)

1. High

   Body parsed as JSON before verify

   express.json() or a framework re-serializes the body, changing whitespace and key order. The signature was computed over the original bytes.

2. High

   Wrong signing secret

   Each endpoint, and each stripe listen session, has its own whsec_ secret. Test vs live and CLI vs Dashboard secrets differ.

3. Low

   Timestamp outside tolerance

   The t= timestamp is older than the 300-second default tolerance, e.g. replayed events or a skewed server clock.

Fix

app.use(express.json());
app.post('/webhooks/stripe', (req, res) => {
  const event = stripe.webhooks.constructEvent(
    req.body, req.headers['stripe-signature'], process.env.STRIPE_WEBHOOK_SECRET);
});

app.post('/webhooks/stripe', express.raw({ type: 'application/json' }), (req, res) => {
  let event;
  try {
    event = stripe.webhooks.constructEvent(
      req.body, req.headers['stripe-signature'], process.env.STRIPE_WEBHOOK_SECRET);
  } catch (err) {
    return res.status(400).send(`Webhook Error: ${err.message}`);
  }
  res.json({ received: true });
});
app.use(express.json());

Verify: reproduce it on purpose

$ curl -s -X POST http://localhost:3000/api/webhooks/stripe -H "Content-Type: application/json" -H "Stripe-Signature: t=1700000000,v1=deadbeef" -d '{"id":"evt_test","type":"payment_intent.succeeded"}'

Prevent

• Store whsec_ per environment; log only its last 4 chars.
• Return 2xx fast and process events in a queue.
• Make handlers idempotent on event.id; Stripe retries for up to 3 days.