## The problem
On AWS Lambda (via API Gateway), stripe.webhooks.constructEvent failed with No signatures found matching the expected signature for payload. API Gateway hands the Lambda a parsed JSON object as the body, and JSON.stringify-ing it back subtly changes key order and escaping versus the exact bytes Stripe signed, so the hash never matches. A second common trap in the same thread: using the wrong secret, e.g. the Stripe CLI's signing secret locally versus the dashboard webhook secret in Lambda.
## What works
Pass the raw request body to constructEvent, not a re-stringified object: on Lambda use event.body as received (the raw string), since any JSON.stringify round-trip changes the bytes and breaks the signature. Also verify you are using the webhook signing secret (whsec_..., from Dashboard > Developers > Webhooks > Reveal), not your API secret (sk_...) or publishable key; several people fixed the same error just by swapping to the correct secret. Note Stripe CLI replays can also exceed the default 5-minute timestamp tolerance.
Source: https://github.com/stripe/stripe-node/issues/356