Stripe webhook signature verification failed
Stripe signs the exact bytes of the request. If your framework parses JSON before you verify, the signature check fails even when the secret is right.
Why this happens
- The handler reads the parsed body instead of the raw payload.
- The webhook secret is from a different endpoint, often the CLI secret pasted into production.
- A proxy rewrites the body on the way in.
What ShipWatch looks for
- ShipWatch does not need your webhook secret. It watches the outcome: after a test payment, is the account paid?
- A signature failure shows up as a paid-access miss, because the plan never changes.
Prompt to paste
Webhook signature verification fails. Verify the signature against the raw request body and the signing secret for this endpoint. Do not JSON.parse the body first. Use the production endpoint secret, not the Stripe CLI secret, once you are off localhost.