Stripe webhook field note
Stripe webhook signature verification failed: check the three inputs
Resolve Stripe 'No signatures found matching the expected signature for payload' errors by checking endpoint secret, raw body, and signature header.
Stripe’s verifier depends on the endpoint secret, the Stripe-Signature header, and the exact UTF-8 body bytes Stripe sent. Test-mode, live-mode, Dashboard, and CLI endpoint secrets differ; JSON parsing or re-serialization also changes the signed bytes.
Treat the complete response as an evidence record: status, headers, provider code, request identifier, method, and raw body. The sequence below separates what the response proves from the checks still needed before a safe retry or code change.
Diagnostic procedure
Work from evidence to recovery.
- 01
Match the endpoint secret
Use the secret for the exact endpoint and environment. A Stripe CLI forwarding secret is not the Dashboard endpoint secret.
- 02
Preserve raw bytes
Capture the body before JSON middleware. Whitespace, key reordering, newline changes, and encoding changes invalidate the HMAC.
- 03
Check timestamp and header
Pass the complete Stripe-Signature header and verify server clock accuracy against the replay tolerance.
express.json() → JSON.stringify(req.body) → constructEvent
express.raw({type:"application/json"}) → untouched req.body → constructEventEvidence
HTTP 429: A rate, quota, concurrency, or resource lock limit blocked the request.
Retry-After is present; it should take precedence over a guessed delay.
The reported request window has no remaining capacity.
Next checks
01Parse Retry-After as either delta-seconds or an HTTP date before scheduling the next attempt.
No account · no upload · no endpoint calledOpen the full incident decoder and operating notes →
FAQ
Before you ship
Does APITC send this evidence to an API?
No. The matching and calculations in the linked workbench run in the active browser tab.
Should every webhook signature response be retried?
No. Retry behavior depends on the method, idempotency protection, provider instructions, and whether the failure is temporary.
Protocol behavior checked against the Stripe webhook signature troubleshooting. Recheck your pinned provider/API version before production deployment.