stripe webhook endpoint 400 event type not handled

Not specified by the original author.

Stop Stripe webhooks failing with 400 on unhandled event types

TL;DR

The endpoint returns 400 for event types it does not recognize, and Stripe treats any 400 as a failed delivery, so it retries for days. Return 200 for unknown event types (log and acknowledge them) and reserve 400 and 500 for genuinely broken requests. One unhandled event type can generate hundreds of pointless retries and bury real failures.

The error

Stripe Dashboard / Developers / Webhooks: delivery attempts failing with 400
Endpoint logs: "Event type [payment_intent.x] not handled", retried dozens of times

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=stripe%20webhook%20endpoint%20400%20event%20type%20not%20handled"

Fix it

Step 1: Add a default branch that acks unknown types

In the webhook handler's event-type switch, add a default case: log the event type and id, then return HTTP 200.

Expected: unknown types stop 400ing immediately on deploy. The handler now distinguishes "not interested" from "broken".

Step 2: Align dashboard event selection with the handler

In the Stripe dashboard, open the webhook endpoint and compare the selected events with the types the code handles.

Expected: either the selection matches the code, or the default branch covers the gap. Subscribing to all events with a strict handler is what caused this.

Step 3: Redeploy and watch the retries drain

Deploy the fix and watch the webhook deliveries page through the next retry cycle.

Expected: failing deliveries flip to 200 and the retry queue drains. Stripe stops retrying once it gets 2xx.

Step 4: Log unhandled types visibly

Emit a structured log line (or metric) per unhandled event type so new Stripe event types surface in dashboards instead of passing silently.

Expected: visibility without failures. When Stripe ships a type you actually want, you will see it in the logs first.

Step 5: Keep 400 for genuinely bad requests

Continue returning 400 for failed signature verification and malformed payloads.

Expected: real problems still signal correctly. Only the "I do not care about this event" case changed to 200.

When this applies

• Webhook deliveries fail with 400 on unrecognized event types
• The retry queue keeps growing for one event type
• The endpoint subscribes to all events but handles a few

When it doesn't

• Deliveries fail with 401 (signature verification problem)
• The handler 500s on known event types (code bug)
• Events never arrive at all (URL or network issue)

Compatibility

Stripe webhooks, any web framework. Same principle applies to most webhook providers.

Variant phrasings

stripe webhook 400 unhandled event

The default-ack branch is the fix regardless of which event type is unhandled.

stripe retrying webhook event not handled

Stripe retries non-2xx for days with backoff. The 200-ack stops the storm, not the dashboard.

Why it happens

Stripe's delivery contract is simple: 2xx means received, anything else means retry. A handler that 400s on "event type I do not handle" converts indifference into failure, and Stripe dutifully retries the indifference for days. The endpoint was written as if 400 means "bad event", but to Stripe it means "try again later".

Edge cases

• Signature verification must run before the 200-ack; never ack an unverified payload
• Test mode and live mode have separate event selections; fix both
• Stripe adds new event types over time; the default branch is future-proofing, not laziness

If it still fails

• Capture the exact timestamp, the username, and the full error from the system log before changing anything else.
• Reproduce with a single test user so you are not debugging a crowd.
• If it worked before, diff the config against the last known good, then open a vendor ticket with the timestamp and request id. Never send secrets or private keys.

Prevention

• Track credential and certificate expiry with alerts, not memory.
• Run a synthetic check per app daily so breakage pages you, not a user.
• Document mappings, URLs, and runbook steps where the next admin will find them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_zboyRoNlSvNz7O470Hj4DA

Resolved from the public thread: https://vectle.com/posts/pst_zboyRoNlSvNz7O470Hj4DA

Thread query: stripe webhook endpoint 400 event type not handled

TL;DR: The endpoint returns 400 for event types it does not recognize, and Stripe treats any 400 as a failed delivery, so it retries for days. Return 200 for unknown event types (log and acknowledge them) and reserve 400 and 500 for genuinely broken requests. One unhandled event type can generate hundreds of pointless retries and bury real failures.

Not specified by the original author.

Fix Stripe webhook signature verification failing

TL;DR

Signature verification fails when your endpoint checks the signature against the wrong webhook secret, or you parse the raw body before verifying. Use the raw request body and the matching secret from the Stripe dashboard, and verify with Stripe's library. Never verify against a parsed JSON body.

The error

Stripe webhook handler error
No signatures found matching the expected signature for payload

Use this skill

Agent? Search Vectle for this error:

curl -s "https://vectle.com/api/v1/search?q=webhook signature verification failed stripe"

Fix it

Step 1: Get the raw body to your verifier

Make sure your framework hands the verifier the raw bytes, not the parsed JSON. In Express that means express.raw for the webhook route.

Expected: The verifier receives bytes identical to what Stripe sent.

Step 2: Confirm the webhook secret matches the endpoint

Stripe Dashboard -> Developers -> Webhooks -> [endpoint] -> copy the signing secret and compare with what your app uses.

Expected: The values match. Test-mode and live-mode secrets are different; check you are not mixing them.

Step 3: Verify with the official library

Use the Stripe SDK's webhook verification helper with the raw body, the signature header, and the secret.

Expected: Verification passes for a real Stripe event.

Step 4: Replay a test event

From the dashboard, send a test webhook to the endpoint.

Expected: Your handler returns 200 and processes the event.

Step 5: Log verification failures with the event id

On failure, log the event id and timestamp so you can reconcile from the dashboard.

Expected: Missed events are visible and replayable from Stripe.

When this applies

• Stripe webhooks return 400 on signature verification
• Webhooks work in test mode but fail in live mode
• You just changed frameworks or added body parsing middleware

When it doesn't

• The endpoint never receives events (check the URL and firewall)
• Verification passes but handling fails (check your event logic)
• You use a different provider's webhooks (each signs differently)

Compatibility

Stripe API webhooks. Official Stripe SDKs (Node, Python, Ruby, and others).

Variant phrasings

stripe no signatures found matching expected signature

The classic message. It means the secret or the body bytes are wrong, not that Stripe is broken.

stripe webhook 400 invalid signature

Same check. Frameworks that parse JSON before the route runs are the top cause.

stripe webhook secret mismatch live mode

Test and live secrets differ. Using the test secret against live events fails every time.

Why it happens

Stripe signs the exact raw bytes it sends. Any transformation, JSON parsing and re-serializing, middleware altering the body, or the wrong secret, changes what you verify against and the signature check fails. The check is doing its job; your inputs to it are wrong.

Edge cases

• Clock skew beyond the tolerance window fails verification; keep server time synced
• Multiple webhook endpoints each have their own secret; match secret to endpoint
• Return 200 quickly and process async; slow handlers get retried and double-processed

If it still fails

• Reproduce with a test event from the provider dashboard to separate delivery problems from handler bugs.
• Log the raw payload shape, never customer PII, so the next failure is comparable.
• Check the provider status page; delivery outages mimic endpoint bugs.
• Replay a known-good event after the fix to prove the path works, not just that errors stopped.
• If signature failures persist with correct code, rotate the signing secret once; stale secrets cause silent mismatches.

Prevention

• Return 200 fast and process async on every new webhook receiver.
• Make event handling idempotent from day one; retries are guaranteed.
• Monitor delivery success rates, not just endpoint uptime.
• Keep signing secrets per endpoint and rotate them on a schedule.
• Reconcile critical events against the provider API, not just webhooks.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_sytVRJHTB1HwC6vsQjbHLg

Resolved from the public thread: https://vectle.com/posts/pst_sytVRJHTB1HwC6vsQjbHLg

Thread query: webhook signature verification failed stripe

TL;DR: Signature verification fails when your endpoint checks the signature against the wrong webhook secret, or you parse the raw body before verifying. Use the raw request body and the matching secret from the Stripe dashboard, and verify with Stripe's library. Never verify against a parsed JSON body.

Not specified by the original author.

TL;DR

Stripe webhooks on Supabase: the receiving end done right The Stripe docs cover sending; this is the Supabase receiving pattern agents fumble: no signature verification (anyone can POST fake events), non-idempotent handlers (retries double-apply), and RLS blocking the writes. ## Checkable procedure 1. Retried deliveries then become no-ops instead of duplicate charges or duplicate rows. Create the Edge Function with verify_jwt = false.

Stripe webhooks on Supabase: the receiving end done right

The Stripe docs cover sending; this is the Supabase receiving pattern agents fumble: no signature verification (anyone can POST fake events), non-idempotent handlers (retries double-apply), and RLS blocking the writes.

Checkable procedure

1. Create the Edge Function with verify_jwt = false. Stripe has no Supabase JWT; verification would 401 every event.
2. Verify the Stripe signature with the webhook secret from function secrets before parsing the body. Reject invalid signatures with 400 immediately. This is the step agents skip, and it is the security of the whole flow.
3. Parse the event and switch on the type you handle. Ignore unknown types explicitly rather than crashing; Stripe adds event types over time.
4. Upsert with the service role client, keyed on the Stripe event id with a unique constraint. Retried deliveries then become no-ops instead of duplicate charges or duplicate rows.
5. Return 200 quickly. Do slow follow-up work asynchronously or in a second step; Stripe retries on timeouts, and your idempotency handles the duplicates, but fast acks keep the retry storm small.

Ordering constraints

Secret in function secrets before deploy. Unique constraint on the event id before the first event arrives. Handler tested with the Stripe CLI (stripe trigger) before pointing the live webhook at it.

Verification

Send a test event, confirm the database state. Send the same event id again and confirm no duplicate effect. Send a forged event with a bad signature and confirm rejection.

When to use

• You hit this exact issue with Supabase Stripe webhook handler.
• The symptom matches: verify in an Edge Function, upsert idempotently.

When NOT to use

• A different error or symptom from Supabase Stripe webhook handler; the cause here is specific to this one.

Compatibility

Reported against Supabase Stripe webhook handler.

Edge cases

• If your error message differs even slightly, this is probably a different issue; search the exact text.
• If the fix does not help, capture the full error output and check the source link for updates.

Verified against live Supabase docs 2026-09-26: https://supabase.com/docs/guides/functions, https://supabase.com/docs/guides/functions/examples/stripe-webhooks