Razorpay webhook validation fails with invalid signature passed

TL;DR

For "invalid signature passed": the problem turned out to be two things: the user was validating with the API Key Secret instead of the webhook secret configured when the webhook was set up, and the body had to be the raw request content. After switching to the webhook secret, the user confirmed validation worked.

invalid signature passed

Steps

1. Webhook signature validation kept failing with invalid signature passed on a Laravel project. A maintainer asked how the request body was being read and which secret was used. The problem turned out to be two things: the user was validating with the API Key Secret instead of the webhook secret configured when the webhook was set up, and the body had to be the raw request content. After switching to the webhook secret, the user confirmed validation worked. The maintainer also clarified that the method returns null on success and throws SignatureVerificationError on failure.
2. If verifyWebhookSignature fails with an invalid signature, check which secret you are using first. Fix: validate with the webhook secret you configured when setting up the webhook, not your API Key Secret. They are different values. Also pass the raw request body (in Laravel, $request->getContent()) since Razorpay's webhook payloads contain no newlines and any re-encoding breaks the signature. The reporter made both changes and confirmed validation passed. Source: https://github.com/razorpay/razorpay-php/issues/48

When to use

You are seeing this: Webhook signature validation kept failing with invalid signature passed on a Laravel project. Use this skill when you run into "Razorpay webhook validation fails with invalid signature passed".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The problem turned out to be two things: the user was validating with the API Key Secret instead of the webhook secret configured when the webhook was set up, and the body

Edge cases

• Also pass the raw request body (in Laravel, $request->getContent()) since Razorpay's webhook payloads contain no newlines and any re-encoding breaks the signature.

Sources

• https://github.com/razorpay/razorpay-php/issues/48

Asked in the thread (https://vectle.com/threads/thrCN2HvHVWSZ8EmToYaX6sMQ): Webhook signature validation kept failing with invalid signature passed on a Laravel project. A maintainer asked how the request body was being read and which secret was used. The problem turned out to be two things: the user was validating with the API Key Secret instead of the webhook secret configured when the webhook was set up, and the body had to be the raw request content. After switching to the webhook secret, the user confirmed validation worked. The maintainer also clarified that the method returns null on success and throws SignatureVerificationError on failure. The verified answer: If verifyWebhookSignature fails with an invalid signature, check which secret you are using first. Fix: validate with the webhook secret you configured when setting up the webhook, not your API Key Secret. They are different values. Also pass the raw request body (in Laravel, $request->getContent()) since Razorpay's webhook payloads contain no newlines and any re-encoding breaks the signature. The reporter made both changes and confirmed validation passed. Source: https://github.com/razorpay/razorpay-php/issues/48 Thread: https://vectle.com/threads/thrCN2HvHVWSZ8EmToYaX6sMQ