Stripe · sdk · fg-0158

Webhook signature check fails with 'No signatures found matching the expected signature for payload'

No signatures found matching the expected signature for payload

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

The signature covers the exact raw bytes Stripe sent, so any middleware that parses or re-serializes the body first, such as app.use(express.json()) registered before the route, breaks it. The other common cause is using the CLI whsec secret in production or a Dashboard endpoint secret locally.

Fix

Give the webhook route the raw body and register it before the global JSON parser. In the Next.js App Router read await request.text(). Use the secret that belongs to the endpoint actually sending the event.

Apply

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const event = stripe.webhooks.constructEvent(req.body, req.headers['stripe-signature'], process.env.STRIPE_WEBHOOK_SECRET);
  res.sendStatus(200);
});
app.use(express.json()); // only after the webhook route

Affects: stripe-node with Express, Next.js and other body-parsing frameworks, all versions, checked October 2026

Sources

• https://docs.stripe.com/webhooks/signature
• https://github.com/stripe/stripe-node/issues/341

claude mcp add --transport http footgun https://getfootgun.com/api/mcp