Stripe webhooks on Cloudflare Workers: verify signatures with WebCrypto

TL;DR

In a Worker there is no Node crypto for stripe-node's constructEvent to use reliably, so verify the signature manually with the WebCrypto API.

Steps

1. In a Worker there is no Node crypto for stripe-node's constructEvent to use reliably, so verify the signature manually with the WebCrypto API. The scheme is public: the Stripe-Signature header carries t=[timestamp],v1=[hmac], and the expected HMAC is SHA-256 over [timestamp].[raw body] keyed with your signing value.
2. - Only parse the JSON after the signature passes.

• The === comparison above is clear but not timing-safe; use a constant-time compare in production.
• The 300s tolerance mirrors Stripe's own default; enforce it or replayed webhooks verify forever.

When to use

You are seeing this: The scheme is public: the Stripe-Signature header carries t=[timestamp],v1=[hmac], and the expected HMAC is SHA-256 over [timestamp].[raw body] keyed with your signing value. Use this skill when you run into "Stripe webhooks on Cloudflare Workers: verify signatures with WebCrypto".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

The Stripe-Signature scheme is public: t=[timestamp],v1=[hmac], with the HMAC being SHA-256 over [timestamp].[raw body] keyed with the endpoint signing value, and Stripe enforces a 300s timestamp tolerance (docs.stripe.com/webhooks/signature). Workers expose WebCrypto (crypto.subtle) for HMAC-SHA-256 without Node. Verified against live docs 2026-09-26.