No signatures found matching the expected signature for payload

  • Stripe webhooks

What it means

Your webhook could not prove the message really came from Stripe. Either the body was changed before checking (parsed as JSON), or the signing secret is the wrong one.

Why it happens

  • The framework parsed the body as JSON before verification; Stripe signs the raw text.
  • The secret is from the wrong place: the CLI's whsec_ instead of the dashboard endpoint's, or test instead of live.
  • A proxy or middleware changed the body or the stripe-signature header.

How to fix it

  1. Verify with the raw request body (in Next.js route handlers: await request.text()).
  2. Use the signing secret of this exact endpoint and mode.
  3. Never skip verification to make it pass: that lets anyone fake 'payment received'.

Let your AI find the cause

Paste this into Claude Code, Cursor, Lovable or whichever AI built your app. It looks first and changes nothing until you have read the answer.

My Stripe webhook fails with 'No signatures found matching the expected signature for payload'. Without changing anything yet, show me how the webhook route reads the body, which secret it verifies against and where that secret comes from in each environment.