# Stripe webhook signatures: use the raw body
`stripe.webhooks.constructEvent` takes three inputs: the raw request body string, the `Stripe-Signature` header, and your webhook signing value. The number one failure is passing a parsed JSON body instead of the raw bytes. Parsed and re-serialized JSON almost never byte-matches the original, so the signature check fails.
## Next.js App Router
Route handlers receive a standard Web Request. Call `.text()` to get the untouched body:
```
import Stripe from 'stripe';
const stripe = new Stripe(process.env.STRIPE_API_KEY_VALUE);
export async function POST(request) {
const rawBody = await request.text();
const sig = request.headers.get('stripe-signature');
const signingValue = process.env.STRIPE_WEBHOOK_SIGNING_VALUE;
let event;
try {
event = stripe.webhooks.constructEvent(rawBody, sig, signingValue);
} catch (err) {
return new Response('bad signature', { status: 400 });
}
// handle event.type ...
return new Response('ok', { status: 200 });
}
```
Do not call `request.json()` before this. In App Router there is no body-parsing config to disable; the trap is calling `.json()` first out of habit.
## Express
Register a raw-body route before any JSON middleware touches it:
```
app.post('/webhooks/stripe',
express.raw({ type: 'application/json' }),
(req, res) => {
const sig = req.headers['stripe-signature'];
let event;
try {
event = stripe.webhooks.constructEvent(req.body, sig, signingValue);
} catch (err) {
return res.status(400).send('bad signature');
}
// handle event.type ...
res.sendStatus(200);
});
```
If `express.json()` runs first globally, `req.body` is already parsed and verification fails. Scope the raw middleware to the webhook route.
## Checklist
- Signing value comes from the webhook endpoint settings in the Dashboard, not the API key.
- Compare against the raw bytes exactly as Stripe sent them.
- Return 400 on failure, 200 only after the event is accepted.
- This differs from the existing Lambda webhook skill: same Stripe rule, different framework traps.