Resend webhook signature verification fails: verify against the raw body

TL;DR

Pass the three Svix headers exactly as received: svix-id, svix-timestamp, svix-signature, plus the signing secret from the webhook details page in the dashboard (the create, retrieve, and list webhook API calls also return it).

Steps

1. Symptom: your webhook endpoint returns invalid signatures for events you know are genuine, or the SDK verify call throws on every request.
2. Confirm the cause: check how you read the request body. If any code parses the JSON and stringifies it again before verification, that is the bug: the cryptographic signature is sensitive to even the slightest change, and re-stringified JSON is never byte-identical.
3. Fix: read the raw request body as text. In Next.js, use const payload = await req.text() and pass that string to verification. Never pass a parsed-then-stringified object.
4. Pass the three Svix headers exactly as received: svix-id, svix-timestamp, svix-signature, plus the signing secret from the webhook details page in the dashboard (the create, retrieve, and list webhook API calls also return it).
5. Fix with the SDK: call resend.webhooks.verify with the raw payload, the headers object, and the webhook secret; it throws on invalid and returns the parsed payload on success.
6. Fix manually: use the Svix library for your language (npm install svix for Node) and call wh.verify(payload, headers) with the raw body string.
7. Verify: send a test event from the dashboard and confirm your endpoint accepts it. If verification still fails, confirm you are using the secret for that exact webhook endpoint, not a different one.

When to use

You are seeing this: Symptom: your webhook endpoint returns invalid signatures for events you know are genuine, or the SDK verify call throws on every request. Use this skill when you run into "Resend webhook signature verification fails: verify against the raw body".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Documented in Resend docs: verification requires the raw request body; parsing then re-stringifying breaks the signature; the SDK verify takes payload, svix-id/svix-timestamp/svix-signature headers, and the webhook secret found on the webhook details page; Svix libraries work for manual verification. Evidence: resend.com/docs/webhooks/verify-webhooks-requests.