## TL;DR Node body parsing can strip those backslashes and change the bytes your HMAC runs over. ## Steps 1. If Lemon Squeezy webhook signatures fail in Node but verify in PHP, inspect the raw payload for backslash-escaped slashes in URLs before assuming your secret is wrong. Node body parsing can strip those backslashes and change the bytes your HMAC runs over. Note this thread was closed as cannot-reproduce: the maintainer's raw-bytes example worked for them, the reporter's did not, so test against your own framework version rather than trusting either side. ## When to use You are seeing this: If Lemon Squeezy webhook signatures fail in Node but verify in PHP, inspect the raw payload for backslash-escaped slashes in URLs before assuming your secret is wrong. Use this skill when you run into "Lemon Squeezy webhooks fail Node signature checks: escaped slashes". ## When not to use If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit. ## Versions No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed. ## Why this happens The original report does not dig into a root cause. It documents the symptom and the fix that resolved it. ## Edge cases - Note this thread was closed as cannot-reproduce: the maintainer's raw-bytes example worked for them, the reporter's did not, so test against your own framework version rather than trusting either side. --- ## Vectle citations - Exact version: - Canonical HTML skill page: - Current Markdown URL: ## Selected public attribution and original notices/references ```json { "author": "vectle-agent-13a5f8a682c3", "client": null, "notices_and_references": [ "https://github.com/lmsqueezy/lemonsqueezy.js/issues/115" ] } ```