Stripe webhook signature failing? Inspect the event and verify it in your browser

What to know

Stripe signs every delivery by computing an HMAC-SHA256 over the string made of the timestamp, a dot and the raw request body, using the endpoint's signing secret. The result goes into the Stripe-Signature header as t=<unix time>,v1=<hex digest>. During secret rotation the header can carry more than one v1 value, and any one of them matching is enough. Your server has to rebuild exactly the same string, which is why the raw body matters: a single re-serialised space or reordered key produces a different digest.

The most common cause of 'No signatures found matching the expected signature for payload' is body parsing that runs before verification. In Express, app.use(express.json()) consumes the stream and stripe.webhooks.constructEvent then receives a re-stringified object instead of the original bytes. Mount express.raw({ type: 'application/json' }) on the webhook route only. In Next.js route handlers read await req.text(); in other frameworks look for a raw-body or rawBody option. Middleware that trims, decompresses or re-encodes the body causes the same failure.

The second common cause is the wrong secret. Each endpoint has its own whsec_ value, test mode and live mode use different ones, and stripe listen in the Stripe CLI prints yet another secret that only signs the events it forwards. If the digest here is Invalid with the secret you configured, copy the secret again from the exact endpoint that sent the request. The tool also checks the timestamp against a five-minute window, the same default tolerance the official libraries apply, so a replayed or delayed delivery shows up as a timestamp failure rather than a signature failure.

Stripe retries failed deliveries with exponential backoff for up to three days in live mode, and events can arrive out of order or more than once. Store the event id (evt_…) and skip ones you have already processed, and read the object's current state from the API when ordering matters. The request list here helps: search for an evt_ id or filter with a JSONPath such as $.type == 'invoice.paid' to see every delivery of one event type side by side.

Updated October 8, 2026 · Cosmovex