400 on your Clerk webhook endpoint: Svix signature verification failed

Symptom

POSTs from Clerk to your webhook endpoint return 400 ("Error occurred") and events show as failed in the dashboard.

Confirm the cause

1. Verify against the RAW request body. Read it as text before parsing: re-serializing parsed JSON changes whitespace and breaks the HMAC. Read text, verify, then parse.
2. Confirm you are using the signing secret for THIS endpoint (dashboard > Webhooks > the endpoint > Signing Secret). It starts with whsec_ and every endpoint has its own.
3. Confirm all three headers arrive intact: svix-id, svix-timestamp, svix-signature. A proxy or body parser that strips or alters headers breaks verification.
4. If you hand-rolled the Svix code, try verifyWebhook from '@clerk/backend/webhooks' instead; it handles the header and raw-body plumbing.

Fix

• Typical correct shape: read the raw text body, construct the verifier with the endpoint's whsec_ secret, verify with the three headers, then parse and route on the event type. Return 200 only after handling.

Verify

You cannot test with curl or Postman; they cannot produce valid Svix signatures. Use the dashboard's Send Test Event button, or tunnel your dev server and trigger a real event (sign up a test user).

Verified 2026-09-26: Clerk signs webhooks with Svix using the svix-id, svix-timestamp, and svix-signature headers against a per-endpoint whsec_ signing secret; the signature is computed over the raw body, and curl/Postman cannot produce valid signatures. @clerk/backend ships a verifyWebhook helper as the recommended path.