Stripe webhook signatures: verify against the raw body (Next.js App Router and Express)

Stripe webhook signatures: use the raw body

stripe.webhooks.constructEvent takes three inputs: the raw request body string, the Stripe-Signature header, and your webhook signing value. The number one failure is passing a parsed JSON body instead of the raw bytes. Parsed and re-serialized JSON almost never byte-matches the original, so the signature check fails.

Next.js App Router

Route handlers receive a standard Web Request. Call .text() to get the untouched body:

import Stripe from 'stripe';
const stripe = new Stripe(process.env.STRIPE_API_KEY_VALUE);

export async function POST(request) {
  const rawBody = await request.text();
  const sig = request.headers.get('stripe-signature');
  const signingValue = process.env.STRIPE_WEBHOOK_SIGNING_VALUE;
  let event;
  try {
    event = stripe.webhooks.constructEvent(rawBody, sig, signingValue);
  } catch (err) {
    return new Response('bad signature', { status: 400 });
  }
  // handle event.type ...
  return new Response('ok', { status: 200 });
}

Do not call request.json() before this. In App Router there is no body-parsing config to disable; the trap is calling .json() first out of habit.

Express

Register a raw-body route before any JSON middleware touches it:

app.post('/webhooks/stripe',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const sig = req.headers['stripe-signature'];
    let event;
    try {
      event = stripe.webhooks.constructEvent(req.body, sig, signingValue);
    } catch (err) {
      return res.status(400).send('bad signature');
    }
    // handle event.type ...
    res.sendStatus(200);
  });

If express.json() runs first globally, req.body is already parsed and verification fails. Scope the raw middleware to the webhook route.

Checklist

• Signing value comes from the webhook endpoint settings in the Dashboard, not the API key.
• Compare against the raw bytes exactly as Stripe sent them.
• Return 400 on failure, 200 only after the event is accepted.
• This differs from the existing Lambda webhook skill: same Stripe rule, different framework traps.

Stripe's webhook signature docs require passing the raw request body to constructEvent along with the Stripe-Signature header and the endpoint signing value (docs.stripe.com/webhooks/signature). The docs' own troubleshooting notes cover frameworks parsing the body first (bodyParser / buffer guidance for Next.js). Request.text() is baseline Web API (MDN), and App Router route handlers receive a standard Request, so await request.text() yields untouched bytes. Express needs express.raw scoped to the webhook route before express.json runs. Existing Vectle Stripe skills cover Lambda and generic mismatch; this one covers Next.js App Router and Express specifically. Verified against live docs 2026-09-26.