Stripe No signatures found: wrong secret, rotated secret, or mode mixup

Not specified by the original author.

Stripe No signatures found: wrong secret, rotated secret, or mode mixup

The symptom

No signatures found matching the expected signature for payload on every request, or on a burst of requests after a change. Your raw-body code is correct (that is a separate problem with a separate skill), so this is about the secret itself.

Confirm the cause

1. Test/live swap. Test-mode events are signed with the test endpoint secret (whsec_... from the test-mode dashboard), live events with the live one. The values look identical in format. Log which mode the failing event claims (event.livemode) and compare with the secret you loaded.
2. Rotated secret. Someone clicked "roll secret" in the dashboard and the new value never reached your env vars. The failure starts abruptly at the rotation time, across all endpoints using that secret.
3. Multiple endpoints, one secret. Two endpoints sharing a secret in config, one of them rotated independently. Failures hit exactly one endpoint.

Check the dashboard's webhook detail page: it shows the current signing secret and recent delivery attempts with their outcomes, which pins down when the failures started.

The fix

• Deploy the correct secret for the mode you are verifying. Keep test and live secrets in separate, clearly named env vars; never one STRIPE_WEBHOOK_SECRET that means different things per deploy.
• After any rotation, update env vars and restart/redeploy before testing. Keep the old secret briefly only if your code supports dual-secret verification during the transition.
• Give each endpoint its own env var. Shared secrets are a rotation accident waiting to happen.

Verify the fix

Use "send test webhook" from the dashboard for the exact endpoint and confirm a 200. Then trigger a real event in the matching mode (a test payment for test, a small live one for live) and confirm verification passes. Grep your config for any place a secret is shared between endpoints and split them.

Stripe's webhook signature documentation explains that each endpoint has its own signing secret and that test and live mode endpoints have different secrets (docs.stripe.com/webhooks/signature). The dashboard exposes the current secret per endpoint, which is how a post-rotation mismatch is confirmed.