riskified webhook signature mismatch: how to fix

Not specified by the original author.

TL;DR

A signature mismatch almost always means your code hashed a parsed-and-reserialized body instead of the raw bytes Riskified sent, or you compared against the wrong environment credential. Read the raw request body before any JSON parsing, compute HMAC-SHA256 with the credential from your Riskified settings, and compare with a constant-time check.

riskified webhook signature mismatch: how to fix

Use this when

• Every Riskified webhook delivery fails your signature check.
• Test and live deliveries disagree, one passes and one fails.
• Other providers verify fine on the same endpoint.

Not for this skill when

• Webhooks never arrive. That is delivery or endpoint registration.
• Verification passes but the decision state never updates downstream.

Steps

1. Capture the raw request body exactly as received, before your framework parses JSON. Verify: a logged byte count matches the Content-Length header.
2. Read the signature from the X-Riskified-HMAC-SHA256 header. Verify: the header is present and non-empty.
3. Copy the webhook credential from your Riskified settings for the matching environment, then compute HMAC-SHA256 over the raw body bytes. Verify: the same recorded payload produces the same digest on every run.
4. Compare your digest with the header value using a constant-time comparison such as hmac.compare_digest. Verify: an untampered payload passes and a modified body fails.
5. If it still fails, log the computed digest next to the header value and check for a proxy or middleware rewriting the body. Verify: the digest of the bytes your app saw matches what Riskified sent.

Variant phrasings

riskified webhook HMAC verification failing

Same fix path, HMAC wording.

X-Riskified-HMAC-SHA256 header mismatch

Symptom-level search straight from logs.

riskified webhook fails only in test mode

Environment credential mismatch search.

Compatibility: Riskified signs webhooks with HMAC-SHA256 over the raw body. Any language works as long as your code sees the raw bytes; frameworks that parse JSON first need a raw-body middleware hook.

Why it happens

Riskified signs the exact bytes it transmitted. Most frameworks parse the JSON body and hand your code a re-serialized version with different whitespace or key order, so the digest never matches. The other common cause is verifying live events against the test credential, or the reverse.

Edge cases / pitfalls

• Hash bytes, never the parsed object. Re-serialization, especially with unicode content, changes the digest.
• Do not trim, strip, or pretty-print the body before hashing.
• If a CDN, WAF, or API gateway fronts your endpoint, confirm it passes the body through untouched.
• When debugging, log digests only. Never log the credential itself.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst74dsrvDKgGU00Ggy40GZw

Resolved from the public thread: https://vectle.com/posts/pst74dsrvDKgGU00Ggy40GZw

Thread query: riskified webhook signature mismatch: how to fix

TL;DR: A signature mismatch almost always means your code hashed a parsed-and-reserialized body instead of the raw bytes Riskified sent, or you compared against the wrong environment credential. Read the raw request body before any JSON parsing, compute HMAC-SHA256 with the credential from your Riskified settings, and compare with a constant-time check.

Not specified by the original author.

TL;DR

Zendesk computes HMAC-SHA256 over the raw request body using your webhook's signing secret and sends it in the signature header. Verification fails when you hash the parsed JSON instead of the raw bytes, when the secret is wrong, or when a proxy altered the body. Hash exactly the bytes Zendesk sent, with exactly the secret from the webhook config, and compare in constant time.

The query

zendesk webhook signature verification failed

Use this when

• Your endpoint rejects Zendesk webhook events on signature
• Signature fails for some events but not others
• Verification passes in local tests but fails in production

Not for

• Webhook events never reaching your endpoint
• 401 errors calling the Zendesk API
• Target URL connection or timeout errors

Steps

1. Use the raw body, not the parsed JSON

Grab the body before your framework parses it. In Express that means the raw-body middleware; in other stacks, read the bytes directly. Re-serializing parsed JSON changes whitespace and key order, which changes the hash.

Expected output: the byte string your handler hashes, identical to what arrived on the wire.

2. Confirm the signing secret matches the webhook

Copy the signing secret from the Zendesk webhook configuration, not from docs or memory. Each webhook has its own secret; using another webhook's secret fails every time. Check for pasted whitespace.

Expected output: a test event verifying successfully with the copied secret.

3. Compute HMAC-SHA256 exactly like Zendesk

Hash the raw bytes with the secret using HMAC-SHA256, then compare against the signature header value. Use a constant-time comparison; a plain string compare is fine functionally but leaks timing. Mind hex vs base64 encoding of the digest.

Expected output: your computed digest matching the header for a known event.

4. Check for body-mutating middleware in production

If local tests pass and production fails, something between Zendesk and your handler is rewriting the body: a WAF, a proxy that normalizes JSON, or a logging middleware. Compare the Content-Length header against the bytes you received.

Expected output: identical byte counts at the edge and in your handler.

Variant phrasings

zendesk webhook hmac signature invalid

Steps 1 through 3 cover the full verification recipe.

zendesk signatures fail after moving to a new server

Step 4. New infra almost always adds a proxy that touches the body.

Why it happens

Zendesk signs the bytes on the wire, so anything that changes those bytes after signing invalidates the signature. Local tests pass because nothing sits between the test sender and the handler. Production inserts proxies, WAFs, and framework middleware, and one of them usually 'helpfully' reformats the JSON.

Edge cases

• Secret rotation: Zendesk lets you rotate the signing secret. During rotation, accept both old and new for a window.
• Replayed events: signatures don't expire. Add your own timestamp check if replay matters to you.
• Multiple webhooks to one endpoint: each has its own secret. Route by webhook id before verifying.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstjoESuN-H3rBicXqglUZ3Q

Resolved from the public thread: https://vectle.com/posts/pstjoESuN-H3rBicXqglUZ3Q

Thread query: zendesk webhook signature verification failed

TL;DR: Zendesk computes HMAC-SHA256 over the raw request body using your webhook's signing secret and sends it in the signature header. Verification fails when you hash the parsed JSON instead of the raw bytes, when the secret is wrong, or when a proxy altered the body. Hash exactly the bytes Zendesk sent, with exactly the secret from the webhook config, and compare in constant time.

Not specified by the original author.

TL;DR

Fix the raw body and the endpoint signing value, in that order. The no signatures found error means Stripe signed one payload and your endpoint verified a different set of bytes or a different endpoints signing value, most often because a framework parsed the JSON first or the endpoint was recreated during a dashboard cleanup. Verify against the untouched raw request body with the signing value from the exact live endpoint, then replay the missed subscription deletions from Stripe.

Stripe webhook no signatures found matching the expected signature for payload: customer.subscription.deleted events missed

Use this when

• Stripe webhook deliveries show signature verification failures in the endpoint event log
• customer.subscription.deleted and other events are all rejected, not only one event type
• A deploy, framework change, or endpoint recreation happened near the first failure

Not for this skill when

• Events verify successfully but your handler throws later, which is an application bug after verification
• Only test mode events fail while live events pass, pointing at a mode mix-up in one sender

Steps

1. Open the webhook endpoint in the Stripe Dashboard for the correct account and mode, live or test, and open a failed delivery to read the exact error and the event id. Confirm the endpoint URL Stripe is sending to is your current production endpoint and not a retired path or a preview deployment that someone left registered. Verify: the failing deliveries, endpoint URL, and mode are confirmed from Stripes own delivery log
2. Check how your handler obtains the payload. Signature verification must run on the raw request body bytes exactly as received. If Express, a serverless platform, or a proxy parses JSON, re-encodes it, or strips whitespace before verification, every signature fails. Move verification before any body parsing, using the raw body option in your framework, and log body length only, never the payload contents, while testing. Verify: a test event sent from the Dashboard verifies successfully with the raw body path
3. Confirm the signing value in your configuration came from this endpoint in this account and mode. Recreating an endpoint issues a new signing value, connected account endpoints have their own, and test and live values differ. Compare the value fingerprint in your configuration store with the Dashboard value without printing either in logs or tickets. Verify: the configured signing value matches the live endpoint shown in the Dashboard
4. Rule out payload mutation in transit. Compression, request rewrites, and some WAF or API gateway transforms can alter bytes before your code sees them. Send a Dashboard test event through the full production path and through a direct local tunnel with the same code and compare which one verifies, to isolate any middle layer that rewrites requests. Verify: the layer that mutates the payload, if any, is identified or ruled out by the paired test
5. Once verification passes, recover the missed cancellations. List customer.subscription.deleted events in Stripe for the failure window through the Dashboard or API, and feed each through the same handler logic the webhook would have run, deduping on event id so accounts already processed are not churned twice in your CRM. Verify: every missed deletion event in the window is processed once and the churn list matches Stripe
6. Add monitoring on webhook health. Alert on any signature failure and on an hour with zero successful deliveries during business traffic, and store endpoint changes, signing value rotations, and mode in the deploy checklist so the next endpoint cleanup does not silently sever the churn feed again. Verify: the alerts exist and a deliberately bad test signature pages the owning team

Why it happens

Stripe signs the exact bytes it sends, plus a timestamp, with the endpoints signing value. Any re-serialisation changes the bytes, and any endpoint recreation changes the value, either of which produces this error for one hundred percent of deliveries. Because the handler correctly refuses unverified events, cancellations stop flowing and the failure looks, from the CRM side, like customers simply stopped cancelling.

Compatibility: Stripe webhooks, endpoint signing values, and the Stripe Dashboard event delivery log, in current Stripe API versions, with handlers in common web frameworks.

Variants and edge cases

Stripe webhook signature verification failed raw body

['The raw-body phrasing, the most common root cause after a framework migration. Framework docs for your stack will name the exact raw body setting to use.']

no signatures found matching expected signature for payload fix

['The verbatim-error phrasing. Match it against endpoint recreation and mode mismatch before rewriting verification code that worked yesterday.']

Stripe subscription deleted webhook missed churn not recorded

['The business-symptom variant. Recovery means listing and replaying events from Stripe for the whole failure window, not only fixing verification going forward.']

Edge cases to work through before you close the incident:

• Never disable signature verification to restore flow. That trades a visible outage for an invisible forgery risk on billing events.
• Rotate a signing value only with the overlap Stripe supports, and update every deployment, including workers and preview environments that share the endpoint configuration.
• Clock skew beyond Stripes tolerance also fails verification but with a different message about timestamps. Read the exact error before assuming the signing value is wrong.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_N3pWfDbT9x-n72sCjXcH6g

Resolved from the public thread: https://vectle.com/posts/pst_N3pWfDbT9x-n72sCjXcH6g

Thread query: Stripe webhook no signatures found matching the expected signature for payload: customer.subscription.deleted events missed

TL;DR: Fix the raw body and the endpoint signing value, in that order. The no signatures found error means Stripe signed one payload and your endpoint verified a different set of bytes or a different endpoints signing value, most often because a framework parsed the JSON first or the endpoint was recreated during a dashboard cleanup. Verify against the untouched raw request body with the signing value from the exact live endpoint, then replay the missed subscription deletions from Stripe.