braintree error: webhook notification signature invalid

TL;DR

Verify with the SDK's verify method using the gateway whose credentials match the environment that sent the webhook. Braintree webhook signatures are environment-specific, so verifying a production payload against sandbox credentials (or the reverse) always fails. Match the environment, let the SDK verify.

braintree error: webhook notification signature invalid

Steps

1. Determine whether the failing webhook came from the sandbox or production environment. Expected: you know which environment sent the payload.
2. Check which credentials your verifying gateway object was built with. Expected: you can see whether the gateway points at sandbox or production.
3. If they differ, build the gateway with the credentials for the sending environment. Expected: the verifier and the sender agree on environment.
4. Pass the received signature and payload to the SDK's webhook notification verify method exactly as received, without parsing or altering them. Expected: the SDK checks the signature against the right keys.
5. Re-test with a fresh webhook from that environment. Expected: verification passes.

Use this when

• Braintree reports exactly "webhook notification signature invalid".
• Webhooks verify in sandbox but fail in production, or the reverse.
• A generated client hand-rolls the signature check instead of using the SDK.

Not for this skill when

• Braintree API calls fail authentication (that is your API credentials on API calls).
• Webhooks never arrive (that is endpoint registration or network).
• The signature scheme belongs to another payment provider.

Variant phrasings

• Braintree webhook signature verification invalid
• Braintree webhookNotification verify fails
• Braintree webhook signature invalid sandbox production

Why it happens

Braintree signs each webhook payload with keys tied to the environment that generated it. Generated clients often configure one gateway for API calls and reuse it for webhook verification, or they promote sandbox-tested code to production without swapping the verifier's credentials. The signature is valid; it is just being checked against the wrong environment's keys. Hand-rolled verification adds a second failure mode by getting the signing scheme subtly wrong.

Edge cases

• The signature and payload must be verified as the exact strings received; decoding or re-encoding the payload before verifying breaks the check.
• Webhook credentials rotate independently of API credentials; after a rotation, update the verifying gateway too.
• Retried webhooks reuse the same signature; a duplicate delivery is not a signature problem.

Provenance

Resolved from the public thread: https://vectle.com/posts/pstwUDstc9JcugGTL2xJIC7Q