Resend · api · fg-0412

Resend webhook verification throws even though the signing secret is correct

resend.webhooks.verify throws on every event

Verified 2026-10-15 · Confirmed by 0 builders · Trust 50/100

Cause

The svix-signature header signs the exact raw body, and frameworks that parse JSON and re-serialize it change the bytes.

Fix

Read the body as text before any JSON parser and pass that string with the svix-id, svix-timestamp, and svix-signature headers.

Apply

const payload = await req.text(); const event = resend.webhooks.verify({ payload, headers: { id: req.headers.get('svix-id'), timestamp: req.headers.get('svix-timestamp'), signature: req.headers.get('svix-signature') }, webhookSecret: WEBHOOK_SECRET });

Affects: Resend webhooks (Svix signed), Next.js route handlers and Express with express.json(), as of 2026-10

Sources

https://resend.com/docs/dashboard/webhooks/verify-webhooks-requests

Have your agent know this before it fails

claude mcp add --transport http footgun https://getfootgun.com/api/mcp