Fixes › Payments

Stripe webhook: No signatures found matching the expected signature

CursorBoltReplitv0

The error

StripeSignatureVerificationError: No signatures found matching the expected signature for payload

Why it happens

constructEvent needs the raw request body exactly as Stripe sent it. Frameworks that parse JSON first (Express json(), Next.js req.json()) change the body, so the signature fails. A wrong webhook secret (CLI secret vs dashboard secret, test vs live) causes the same error.

How to fix it

1. Read the raw body: in Next.js App Router use await req.text(); in Express use express.raw({type: 'application/json'}) on that route only.
2. Use the whsec_ secret for this exact endpoint and mode (stripe listen prints a different one).
3. Pass the stripe-signature header unchanged.
4. Return 200 quickly and do slow work afterwards.

Fix prompt (paste into Lovable, Bolt, Cursor, Replit or v0)

My Stripe webhook fails with 'No signatures found matching the expected signature'. Rewrite the webhook route to verify using the raw request body (req.text() in Next.js App Router or express.raw for that route), read STRIPE_WEBHOOK_SECRET from server env, return 400 on bad signatures and 200 after handling checkout.session.completed. Don't parse JSON before verification.

FAQ

Which secret do I use locally?

The whsec_ printed by stripe listen. In production use the endpoint's secret from the Dashboard.

Test vs live?

Each mode and each endpoint has its own signing secret.

Related fixes

• Payment succeeds but the user isn't upgraded
• No such price / No such customer (test vs live mode mix-up)
• Supabase query returns an empty array (no error)
• new row violates row-level security policy for table