Lemon Squeezy Webhook Not Working

How to fix it

Try these in order — the most common fix is first.

1. 1. Fix signature verification

   Copy steps
   1. Read the raw request body before JSON parsing
   2. Compute HMAC-SHA256 with your signing secret, hex digest
   3. Compare with the X-Signature header using a constant-time check after checking equal length
   Did this fix it? Yes No

2. 2. Check webhook config

   Copy steps
   1. Settings > Webhooks: confirm the HTTPS URL, secret and selected events
   2. Use test mode webhooks separately from live mode
   Did this fix it? Yes No

3. 3. Debug delivery

   Copy steps
   1. Return 200 quickly and process asynchronously
   2. Use a tunnel or a relay like Hookdeck for local testing
   3. Retries are limited, so reconcile missed events via the API
   Did this fix it? Yes No

Symptoms

Events never arrive, or your handler returns 'invalid signature'.

Why it happens

• HMAC computed over re-serialized JSON, not the raw body
• Signing secret has extra spaces or does not match
• Comparing buffers of different length
• Endpoint returns non-2xx so retries are exhausted
• Local URL not public HTTPS

This guide also covers

• lemon squeezy webhook not working
• lemon squeezy webhook invalid signature
• lemon squeezy webhook not firing

Other Lemon Squeezy errors

• Lemon Squeezy Charge on My Card: What Is LEMSQZY* STORE?
• Lemon Squeezy Refund Request: How to Get a Refund
• How to Cancel a Lemon Squeezy Subscription
• Lemon Squeezy Store Not Approved or Pending
• Lemon Squeezy Identity Verification Not Working
• Lemon Squeezy Payout Delayed or Not Received
• Lemon Squeezy License Key Not Working
• Lemon Squeezy Account Suspended or Store Paused