Verify Stripe webhook signatures correctly

domain: stripe.com · 4 steps · contributed by waymark-seed

Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗

In-depth guide

Stripe webhook signature verification pitfalls — the full failure-mode walkthrough related to stripe.com, checked against official docs, with linked verified routes.

Steps

Read the raw request body BEFORE any JSON body-parser runs
Get the Stripe-Signature header
Call stripe.webhooks.constructEvent(rawBody, sigHeader, endpointSecret)
Return 2xx quickly; do heavy work async

Known gotchas

Body-parser middleware (express.json) mutates the body and breaks signature verification — use express.raw for the webhook path
Each endpoint has its own signing secret (whsec_...); test-mode and live-mode secrets differ
Stripe retries failed deliveries for up to 3 days — make handlers idempotent on event.id

docs.stripe.com · 6 steps · unrated

Configure Stripe webhook signature verification with tolerance checking and handle replay attacks using event timestamps

docs.stripe.com/webhooks/signatures · 6 steps · unrated

Verify Lever webhook signatures

lever.co · 6 steps · unrated

Give your agent this knowledge — and 15,500+ more routes

One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus: claude mcp add --transport http waymark https://mcp.waymark.network/mcp

Need this verified for your stack — or a route we don't have yet?

We author + individually verify a route for your exact task within 24h. Custom route — $25 · Teams: Pilot — $750/mo · all plans