Error fixes / Stripe
Stripe
Stripe webhook signature verification failed
constructEvent could not match the body, the Stripe-Signature header, and the endpoint secret.
The error
Webhook signature verification failed. Err: No signatures found matching the expected signature for payload.
What it means
Stripe's docs say this exact error means at least one of the three constructEvent inputs is wrong. The most common mistake is the wrong endpoint secret: the Stripe CLI prints one secret, and the Dashboard endpoint has another. The next mistake is a framework parsing the JSON before verification, which changes the bytes. The signature is computed on the raw UTF-8 body Stripe sent.
Fix
- Print only the prefix of the secret you are using (whsec_) and compare it with the endpoint you are testing. CLI forwarding and the Dashboard endpoint do not share a secret.
- Read the raw body. In Next.js App Router, call request.text() and pass that string to constructEvent. Do not pass a parsed object.
- Pass the Stripe-Signature header unchanged. Stripe shows the shape t=...,v1=....
- If you use Express, mount this route before express.json().
- Retry with the Stripe CLI or Dashboard 'send test event' against the same secret the server has.
Prompt
Fix prompt
Stripe webhooks throw: No signatures found matching the expected signature for payload. Fix the route so constructEvent receives the raw UTF-8 body, the stripe-signature header, and the endpoint secret from the environment. Do not JSON.parse the body first. Document that the CLI secret and the Dashboard secret are different. Do not print the secret. Point me at the handler you changed.
Questions
Why does a test event from the CLI fail on production?
They are different endpoints. Production must use the signing secret shown on that Dashboard endpoint. The CLI secret only works for events the CLI forwards.
The body looks like valid JSON. Why is that not enough?
Stripe signs the exact bytes. Reordering keys, parsing and stringifying, or changing whitespace produces a different signature. Pass the raw body through.
Can I skip verification in development?
You can miss the bug you are about to ship. Use the CLI secret locally and the Dashboard secret in production, and verify in both places.