What This Error Means
When you see “Stripe signature verification failed”, it means your server could not confirm that the webhook request actually came from Stripe.
Stripe signs every webhook request using a secret key. If your system cannot verify that signature, it rejects the request for security reasons.
Why This Matters
This is not just a technical glitch—it’s a security checkpoint.
If verification fails:
- Your app ignores legitimate payment events
- Orders may not update
- Users may not get access
- Your system becomes unreliable
Most Common Causes
1. Wrong Webhook Secret
Each webhook endpoint has a unique signing secret.
- Using the wrong secret = instant failure
- Mixing test and live secrets is a common mistake
2. Modified Request Body
Stripe requires the raw request body.
If your framework:
- Parses JSON automatically
- Alters whitespace or formatting
Signature verification will fail.
3. Incorrect Header Used
Stripe sends the signature in:
Stripe-Signature
If you read the wrong header or miss it entirely, verification breaks.
4. Time Difference (Timestamp Issue)
Stripe includes a timestamp in the signature.
If your server clock is significantly off:
- Verification may fail
5. Wrong Endpoint Configuration
- Webhook URL mismatch
- Using a secret from a different endpoint
Fix Checklist (Follow in Order)
Step 1: Confirm Webhook Secret
Go to:
Stripe Dashboard → Developers → Webhooks
- Select your endpoint
- Copy the correct Signing Secret
Make sure:
- Test mode uses test secret
- Live mode uses live secret
Step 2: Use Raw Request Body
This is the #1 issue.
Node.js (Express Example)
app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
const sig = req.headers['stripe-signature']; try {
const event = stripe.webhooks.constructEvent(
req.body,
sig,
endpointSecret
); res.status(200).send();
} catch (err) {
res.status(400).send(`Webhook Error: ${err.message}`);
}
});
Step 3: Check Header Extraction
Ensure you are reading:
Stripe-Signature
Exactly as sent.
Step 4: Sync Server Time
- Use NTP (Network Time Protocol)
- Ensure your server clock is accurate
Step 5: Test with Stripe CLI
Use Stripe CLI to simulate events:
stripe listen --forward-to localhost:3000/webhook
This helps confirm your setup works locally.
Best Practices for Stable Verification
1. Keep Secrets Secure
- Never expose webhook secrets publicly
- Store them in environment variables
2. Handle Errors Gracefully
- Log failed verifications
- Monitor repeated failures
3. Separate Test and Live Environments
Avoid mixing credentials.
4. Use Official Stripe Libraries
They handle signature validation correctly and securely.
What NOT to Do
- Don’t parse JSON before verification
- Don’t hardcode secrets in your code
- Don’t ignore verification failures
- Don’t reuse secrets across endpoints
How to Know It’s Fixed
You’ll see:
- Webhooks marked “Delivered” in Stripe dashboard
- No more signature errors in logs
- Events processed successfully
Final Insight
Signature verification is your system’s gatekeeper.
If it fails, your app stops trusting incoming data—and that’s exactly what it should do.
Fix the verification properly, and your Stripe integration becomes both secure and reliable.