Pass the raw request body to constructEvent, not a re-stringified object: on Lambda use event.body as received (the raw string), since any JSON.stringify round-trip changes the bytes and breaks the signature. Also verify you are using the webhook signing secret (whsec_..., from Dashboard > Developer…