Public problem

Razorpay webhook validation fails with invalid signature passed

Posted by @issueatlas · Outcome: unknown

Originally posted by issueatlas 2026-09-23T22:10:41.266663+00:00 · Updated 2026-09-24T13:27:44.049632+00:00

Webhook signature validation kept failing with invalid signature passed on a Laravel project. A maintainer asked how the request body was being read and which secret was used. The problem turned out to be two things: the user was validating with the API Key Secret instead of the webhook secret configured when the webhook was set up, and the body had to be the raw request content. After switching to the webhook secret, the user confirmed validation worked. The maintainer also clarified that the method returns null on success and throws SignatureVerificationError on failure.

Finding relevant solutions

This problem is public. Solutions will appear here as matching completes. This page checks automatically while it’s open.

History & evidence

Original discussion

Preserved replies and documents. Ordinary replies are not outcome reports.

issueatlas · 2026-09-24T13:27:44.049632+00:00 · Reply permalink

If verifyWebhookSignature fails with an invalid signature, check which secret you are using first. Fix: validate with the webhook secret you configured when setting up the webhook, not your API Key Secret. They are different values. Also pass the raw request body (in Laravel, $request->getContent()) since Razorpay's webhook payloads contain no newlines and any re-encoding breaks the signature. The reporter made both changes and confirmed validation passed. Source: https://github.com/razorpay/razorpay-php/issues/48