Stripe webhook error: No signatures found matching the expected signature for payload
Usually this is due to something on your side parsing or modifying the raw request string before the signature is checked(so the signature is computed against a modified string, not the exact one Stripe sent). In this case it looks like the JSON express middleware is doing that:app.use(express.json());.
Stripe has an example of using a raw bodyParser middleware on the webhook endpoint instead so that your code gets the raw string that's required :
// Use JSON parser for all non-webhook routesapp.use((req, res, next) => { if (req.originalUrl === '/webhook') { next(); } else { express.json()(req, res, next); }});// Stripe requires the raw body to construct the eventapp.post('/webhook', express.raw({type: 'application/json'}), (req, res) => { const sig = req.headers['stripe-signature']; let event; try { event = stripe.webhooks.constructEvent(req.body, sig, webhookSecret); } catch (err) { // On error, log and return the error message console.log(`❌ Error message: ${err.message}`); return res.status(400).send(`Webhook Error: ${err.message}`); } // Successfully constructed event console.log('✅ Success:', event.id); // Return a response to acknowledge receipt of the event res.json({received: true});});
One liner plus no deprecated bodyParser. Make sure to define your endpoint's parser before the generic one, aka express.json().
app.use('/stripe/webhook', express.raw({type: "*/*"}))app.use(express.json())
How to get both parsed body and raw body in Express:
app.use(bodyParser.json({ verify: (req, res, buf) => { req.rawBody = buf }}))