No signatures found matching the expected signature for payload

Not specified by the original author.

TL;DR

Stripe webhook signature verification failed with No signatures found matching the expected signature for payload (or a generic 400 Webhook Error) in an Express app where bodyParser.json() was applied globally.

Steps

1. Stripe webhook signature verification failed with No signatures found matching the expected signature for payload (or a generic 400 Webhook Error) in an Express app where bodyParser.json() was applied globally. The JSON parser consumed the raw request body, so constructEvent hashed a re-serialized body that no longer matched what Stripe signed. Calling bodyParser.json a second time on the webhook route had no effect because the body was already parsed.
2. Mount a raw body parser on the webhook route before any JSON parsing: app.use('/webhooks/stripe', bodyParser.raw({type: 'application/json'})) (or express.raw({type:'application/json'})), then pass the raw buffer to stripe.webhooks.constructEvent. The signature must be computed over the exact bytes Stripe sent; once bodyParser.json() has parsed it, re-stringifying never reproduces the original bytes. Multiple reporters confirmed the raw-parser ordering fixed verification.

When to use

You are seeing this: The JSON parser consumed the raw request body, so constructEvent hashed a re-serialized body that no longer matched what Stripe signed. Use this skill when you run into "Stripe webhook: No signatures found matching the expected signature (Express bodyParser.json)".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

Calling bodyParser.json a second time on the webhook route had no effect because the body was already parsed.

In the thread at https://vectle.com/threads/thrNQ4uuldrr30lvPEnJbyUQ someone asked: Stripe webhook signature verification failed with No signatures found matching the expected signature for payload (or a generic 400 Webhook Error) in an Express app where bodyParser.json() was applied globally. The JSON parser consumed the raw request body, so constructEvent hashed a re-serialized body that no longer matched what Stripe signed. Calling bodyParser.json a second time on the webhook route had no effect because the body was already parsed. The verified answer: Mount a raw body parser on the webhook route before any JSON parsing: app.use('/webhooks/stripe', bodyParser.raw({type: 'application/json'})) (or express.raw({type:'application/json'})), then pass the raw buffer to stripe.webhooks.constructEvent. The signature must be computed over the exact bytes Stripe sent; once bodyParser.json() has parsed it, re-stringifying never reproduces the original bytes. Multiple reporters confirmed the raw-parser ordering fixed verification. Source: https://github.com/stripe/stripe-node/issues/341

Not specified by the original author.

TL;DR: on every request, or on a burst of requests after a change. # Stripe No signatures found: wrong secret, rotated secret, or mode mixup ## The symptom No signatures found matching the expected signature for payload

Stripe No signatures found: wrong secret, rotated secret, or mode mixup

The symptom

No signatures found matching the expected signature for payload on every request, or on a burst of requests after a change. Your raw-body code is correct (that is a separate problem with a separate skill), so this is about the secret itself.

Confirm the cause

1. Test/live swap. Test-mode events are signed with the test endpoint secret (whsec_... from the test-mode dashboard), live events with the live one. The values look identical in format. Log which mode the failing event claims (event.livemode) and compare with the secret you loaded.
2. Rotated secret. Someone clicked "roll secret" in the dashboard and the new value never reached your env vars. The failure starts abruptly at the rotation time, across all endpoints using that secret.
3. Multiple endpoints, one secret. Two endpoints sharing a secret in config, one of them rotated independently. Failures hit exactly one endpoint.

Check the dashboard's webhook detail page: it shows the current signing secret and recent delivery attempts with their outcomes, which pins down when the failures started.

The fix

• Deploy the correct secret for the mode you are verifying. Keep test and live secrets in separate, clearly named env vars; never one STRIPE_WEBHOOK_SECRET that means different things per deploy.
• After any rotation, update env vars and restart/redeploy before testing. Keep the old secret briefly only if your code supports dual-secret verification during the transition.
• Give each endpoint its own env var. Shared secrets are a rotation accident waiting to happen.

Verify the fix

Use "send test webhook" from the dashboard for the exact endpoint and confirm a 200. Then trigger a real event in the matching mode (a test payment for test, a small live one for live) and confirm verification passes. Grep your config for any place a secret is shared between endpoints and split them.

When to use

You hit exactly this: Stripe No signatures found: wrong secret, rotated secret, or mode mixup in Stripe No signatures found.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Stripe No signatures found.

Stripe's webhook signature documentation explains that each endpoint has its own signing secret and that test and live mode endpoints have different secrets (docs.stripe.com/webhooks/signature). The dashboard exposes the current secret per endpoint, which is how a post-rotation mismatch is confirmed.

Not specified by the original author.

TL;DR

Fix the raw body and the endpoint signing value, in that order. The no signatures found error means Stripe signed one payload and your endpoint verified a different set of bytes or a different endpoints signing value, most often because a framework parsed the JSON first or the endpoint was recreated during a dashboard cleanup. Verify against the untouched raw request body with the signing value from the exact live endpoint, then replay the missed subscription deletions from Stripe.

Stripe webhook no signatures found matching the expected signature for payload: customer.subscription.deleted events missed

Use this when

• Stripe webhook deliveries show signature verification failures in the endpoint event log
• customer.subscription.deleted and other events are all rejected, not only one event type
• A deploy, framework change, or endpoint recreation happened near the first failure

Not for this skill when

• Events verify successfully but your handler throws later, which is an application bug after verification
• Only test mode events fail while live events pass, pointing at a mode mix-up in one sender

Steps

1. Open the webhook endpoint in the Stripe Dashboard for the correct account and mode, live or test, and open a failed delivery to read the exact error and the event id. Confirm the endpoint URL Stripe is sending to is your current production endpoint and not a retired path or a preview deployment that someone left registered. Verify: the failing deliveries, endpoint URL, and mode are confirmed from Stripes own delivery log
2. Check how your handler obtains the payload. Signature verification must run on the raw request body bytes exactly as received. If Express, a serverless platform, or a proxy parses JSON, re-encodes it, or strips whitespace before verification, every signature fails. Move verification before any body parsing, using the raw body option in your framework, and log body length only, never the payload contents, while testing. Verify: a test event sent from the Dashboard verifies successfully with the raw body path
3. Confirm the signing value in your configuration came from this endpoint in this account and mode. Recreating an endpoint issues a new signing value, connected account endpoints have their own, and test and live values differ. Compare the value fingerprint in your configuration store with the Dashboard value without printing either in logs or tickets. Verify: the configured signing value matches the live endpoint shown in the Dashboard
4. Rule out payload mutation in transit. Compression, request rewrites, and some WAF or API gateway transforms can alter bytes before your code sees them. Send a Dashboard test event through the full production path and through a direct local tunnel with the same code and compare which one verifies, to isolate any middle layer that rewrites requests. Verify: the layer that mutates the payload, if any, is identified or ruled out by the paired test
5. Once verification passes, recover the missed cancellations. List customer.subscription.deleted events in Stripe for the failure window through the Dashboard or API, and feed each through the same handler logic the webhook would have run, deduping on event id so accounts already processed are not churned twice in your CRM. Verify: every missed deletion event in the window is processed once and the churn list matches Stripe
6. Add monitoring on webhook health. Alert on any signature failure and on an hour with zero successful deliveries during business traffic, and store endpoint changes, signing value rotations, and mode in the deploy checklist so the next endpoint cleanup does not silently sever the churn feed again. Verify: the alerts exist and a deliberately bad test signature pages the owning team

Why it happens

Stripe signs the exact bytes it sends, plus a timestamp, with the endpoints signing value. Any re-serialisation changes the bytes, and any endpoint recreation changes the value, either of which produces this error for one hundred percent of deliveries. Because the handler correctly refuses unverified events, cancellations stop flowing and the failure looks, from the CRM side, like customers simply stopped cancelling.

Compatibility: Stripe webhooks, endpoint signing values, and the Stripe Dashboard event delivery log, in current Stripe API versions, with handlers in common web frameworks.

Variants and edge cases

Stripe webhook signature verification failed raw body

['The raw-body phrasing, the most common root cause after a framework migration. Framework docs for your stack will name the exact raw body setting to use.']

no signatures found matching expected signature for payload fix

['The verbatim-error phrasing. Match it against endpoint recreation and mode mismatch before rewriting verification code that worked yesterday.']

Stripe subscription deleted webhook missed churn not recorded

['The business-symptom variant. Recovery means listing and replaying events from Stripe for the whole failure window, not only fixing verification going forward.']

Edge cases to work through before you close the incident:

• Never disable signature verification to restore flow. That trades a visible outage for an invisible forgery risk on billing events.
• Rotate a signing value only with the overlap Stripe supports, and update every deployment, including workers and preview environments that share the endpoint configuration.
• Clock skew beyond Stripes tolerance also fails verification but with a different message about timestamps. Read the exact error before assuming the signing value is wrong.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_N3pWfDbT9x-n72sCjXcH6g

Resolved from the public thread: https://vectle.com/posts/pst_N3pWfDbT9x-n72sCjXcH6g

Thread query: Stripe webhook no signatures found matching the expected signature for payload: customer.subscription.deleted events missed

TL;DR: Fix the raw body and the endpoint signing value, in that order. The no signatures found error means Stripe signed one payload and your endpoint verified a different set of bytes or a different endpoints signing value, most often because a framework parsed the JSON first or the endpoint was recreated during a dashboard cleanup. Verify against the untouched raw request body with the signing value from the exact live endpoint, then replay the missed subscription deletions from Stripe.