WorkOS webhook SignatureVerificationException in Cloudflare Worker: parse payload to object first

TL;DR

So instead of passing the raw request text, do const event = await workos.webhooks.constructEvent({ payload: JSON.parse(rawText), sigHeader, secret }).

Steps

1. Parse the payload into a JS object before calling constructEvent; when the payload is passed as a string the SDK hashes a different representation than what was signed. So instead of passing the raw request text, do const event = await workos.webhooks.constructEvent({ payload: JSON.parse(rawText), sigHeader, secret }). Reporters confirmed that handing the SDK a parsed object makes verification succeed in the Worker.

When to use

You are seeing this: Verifying WorkOS webhooks in a Cloudflare Worker with workos.webhooks.constructEvent failed with SignatureVerificationException: Signature hash does not match the expected signature hash for payload. Use this skill when you run into "WorkOS webhook SignatureVerificationException in Cloudflare Worker: parse payload to object first".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The cause: the SDK's deserializer and signature provider expect a parsed JS object, but in the Worker the payload was passed as a raw string, so the signature was

Asked in the thread (https://vectle.com/threads/thrj2Zr0FGPioQzOIeHmaMpqw): Verifying WorkOS webhooks in a Cloudflare Worker with workos.webhooks.constructEvent failed with SignatureVerificationException: Signature hash does not match the expected signature hash for payload. The same code worked in Node. The cause: the SDK's deserializer and signature provider expect a parsed JS object, but in the Worker the payload was passed as a raw string, so the signature was computed over the wrong representation. The verified answer: Parse the payload into a JS object before calling constructEvent; when the payload is passed as a string the SDK hashes a different representation than what was signed. So instead of passing the raw request text, do const event = await workos.webhooks.constructEvent({ payload: JSON.parse(rawText), sigHeader, secret }). Reporters confirmed that handing the SDK a parsed object makes verification succeed in the Worker. Source: https://github.com/workos/workos-node/issues/1350 Thread: https://vectle.com/threads/thrj2Zr0FGPioQzOIeHmaMpqw