Recommended Free Tools
If a Stripe webhook signature check works locally but fails after you deploy an Express app, first check whether JSON middleware has changed the request body before verification. Stripe verifies the original, unmodified payload. Then check the signing secret, server clock and production endpoint configuration. The Stripe-specific code below is an example; if you use another webhook provider, follow its own signing instructions and header format.
1. Preserve the raw request body
Stripe signature verification needs the incoming request body in its original form. If express.json() runs first, it parses the payload into a JavaScript object; passing that parsed object to verification will not reproduce the original bytes. Stripe describes the requirement as the “raw, unmodified body” of the incoming request.
As an Amazon Associate I earn from qualifying purchases.
In Stripe’s Express example, the webhook route uses express.raw({ type: 'application/json' }), while other routes can continue using JSON parsing. Register the webhook route before any app-wide parser that would consume its request stream:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →import express from 'express';
import Stripe from 'stripe';
const app = express();
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
const signature = req.headers['stripe-signature'];
try {
const event = stripe.webhooks.constructEvent(
req.body,
signature,
process.env.STRIPE_WEBHOOK_SECRET
);
// Handle the verified event here.
res.sendStatus(200);
} catch (err) {
res.status(400).send(`Webhook signature verification failed: ${err.message}`);
}
});
app.use(express.json());
// Define other JSON-parsing routes below.This follows the ordering in Stripe’s Express webhook signing example. Express also documents a JSON parser verify(req, res, buf, encoding) callback that provides the raw buffer if an application has a reason to capture it while parsing; see the Express API documentation. Do not stringify a parsed object and assume the result is byte-for-byte identical to what Stripe sent.
#1 Best Overall
- HTML CSS Design and Build Web Sites
- Comes with secure packaging
- It can be a gift option
2. Verify the signing secret belongs to this endpoint
A correct raw body can still fail verification when the signing secret is wrong. Check the value loaded by the deployed process, not just the value in your local environment, and confirm it belongs to the exact Stripe endpoint sending the event. A dashboard endpoint’s secret and the secret printed for a running Stripe CLI listener are not interchangeable.
In the Stripe Dashboard, compare the endpoint that receives the production event with the secret configured for that deployment. Stripe lists an incorrect endpoint signing secret among common causes of a signature mismatch in its webhook 4xx/5xx troubleshooting guidance. Keep secrets out of source control and logs.
Rank #2
- Brand: Wiley
- Set of 2 Volumes
- A handy two-book set that uniquely combines related technologies Highly visual format and accessible language makes these books highly effective learning tools Perfect for beginning web designers and front-end developers
3. Check timestamp-related failures and server time
If the error says the signature timestamp is outside the tolerance zone, verify that the production host has the correct date and time. Also make verification promptly after the request arrives: delayed processing can make a timestamp check fail even when the event body and secret are otherwise correct. Stripe identifies clock problems and delayed verification as possible causes.
4. Compare the deployed endpoint and infrastructure
If the handler works locally but not in production, compare the deployed route and request path with the working local setup. Confirm the registered Stripe URL is the intended production URL, the endpoint is enabled, and it subscribes to the event types the application expects. Stripe’s Webhook Endpoints API reference documents endpoint configuration.
- Check that the deployed Express route matches the registered URL path.
- Compare middleware order and configuration between local and production.
- Review application, web-server and hosting logs for route errors, parsing failures or recent configuration changes.
- Check whether a server update or deployment changed how the request reaches the handler.
Stripe Support notes that new or changed code, a server update or a configuration change can introduce a new failure mode. A 4xx or 5xx response may therefore point to a deployment or routing issue as well as a signature mismatch.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Keep verification specific to the webhook provider
Validate a webhook signature before processing its event. GitHub, for example, explains that its delivery signature is generated from the webhook secret token and payload contents; its guidance is to validate webhook deliveries. That shared payload-and-secret principle does not make providers’ algorithms, headers or timestamp rules interchangeable. Use the provider’s official verification function, required body representation, signature header and secret source.
Quick Recap
Best Value
- These are the words in Charlotte's web, high in the barn
- Her spiderweb tells of her feelings for a little pig named Wilbur, as well as the feelings of a little girl named Fern … who loves Wilbur, too
- Their love has been shared by millions of readers
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
