Stripe Webhook Signature Verification Failed

How to fix it

Try these in order — the most common fix is first.

1. 1. Use the right secret

   Copy steps
   1. Dashboard endpoint: open it in Workbench and click Reveal secret
   2. CLI: use the whsec_ secret printed when you run stripe listen
   3. The two are different; print the value in your code and check for extra whitespace
   Did this fix it? Yes No

2. 2. Pass the raw body

   Copy steps
   1. Express: register the webhook route before app.use(express.json())
   2. Next.js App Router: read the raw text body as in Stripe's stripe-node example
   3. Next.js Pages Router: disable bodyParser and use buffer(request)
   4. AWS API Gateway: add a body mapping template and read event.rawBody
   Did this fix it? Yes No

3. 3. Check the header

   Copy steps
   1. Print Stripe-Signature; it should contain t= and at least one v1= entry
   2. Accept unknown entries; do not depend on a fixed order or count
   3. Do not use the optional debug metadata for authentication
   Did this fix it? Yes No

4. 4. Roll the secret if unsure

   1. In Workbench use Roll secret; you can keep the old one active for up to 7 days while you update your server
   Did this fix it? Yes No

Symptoms

Your webhook handler returns 400 and logs 'Webhook signature verification failed. Err: No signatures found matching the expected signature for payload.'

Why it happens

• Using the Dashboard endpoint secret with stripe listen (or the reverse)
• Whitespace or the wrong whsec_ value in the environment variable
• Framework parsed or re-serialized the body before verification
• express.json() registered before the webhook route
• Next.js Pages Router body parser left enabled
• Header extracted incorrectly or proxy modified the body

This guide also covers

• stripe webhook signature verification failed
• no signatures found matching the expected signature for payload
• stripe webhook 400
• stripe constructEvent error

Other Stripe errors

• Stripe Account Under Review: What to Do
• Stripe Payouts Paused or Pending: Why and How to Fix
• Stripe 'Your Card Was Declined' (generic_decline, do_not_honor)
• Stripe authentication_required / 3D Secure Decline
• Stripe Webhooks Not Firing or Failing (302, 400, 500, Timeout)
• Stripe Dispute Lost: What Happens and Can You Appeal
• Stripe Account Restricted: Verification Information Required
• Stripe Radar Blocking Legitimate Payments