Webhook Signature Playground

Stripe and most other providers sign the exact bytes they sent — including whitespace, key order, and trailing newlines. The moment Express or Flask runs JSON.parse() on the body and your code re-serializes it, the signature no longer matches the bytes you signed. Use express.raw({ type: "application/json" }) on the webhook route, before any json parser. In Flask, read request.get_data(as_text=False), not request.json.

// Express.js — RIGHT
app.post('/webhook',
  express.raw({ type: 'application/json' }), // ← raw body, not json
  (req, res) => {
    const sig = req.headers['stripe-signature']
    const event = stripe.webhooks.constructEvent(
      req.body,           // Buffer of raw bytes
      sig,
      process.env.STRIPE_WEBHOOK_SECRET
    )
    res.json({ received: true })
  }
)

Stripe issues a different signing secret per webhook endpoint. Test-mode and Live-mode are separate secrets — using the test-mode secret in production fails silently with a signature mismatch. Same trap with the Stripe CLI: `stripe listen` generates an ephemeral signing secret that is different from your dashboard endpoint's secret. Confirm which secret your code is loading by logging the first 6 characters (whsec_xxxxxx) — never log the full value.

# Sanity check before going live (Python)
import os
secret = os.environ['STRIPE_WEBHOOK_SECRET']
assert secret.startswith('whsec_'), f'Expected whsec_, got {secret[:6]}'
print(f'Loaded secret: {secret[:10]}…')

Stripe rejects signatures older than 5 minutes by default. If you're testing with a stored payload from earlier today, the HMAC itself may be correct but the timestamp check fails first. Slack has the same 5-minute rule. The fix in production is not to widen the tolerance — it's to defend against replay attacks at the receiver layer. The fix while testing is to generate a fresh signature against the current timestamp using this playground's Compute mode.

# Stripe SDK respects tolerance automatically:
event = stripe.Webhook.construct_event(
    payload, sig_header, webhook_secret,
    tolerance=300,  # default 5 min — don't make this larger in prod
)

Most providers HMAC-then-hex-encode. Shopify HMAC-then-base64-encodes. Comparing your computed hex against the X-Shopify-Hmac-Sha256 header will always fail because they're different encodings of the same bytes. The fix is one character in your hashing call: digest('base64') instead of digest('hex').

// Shopify verification — note .digest('base64')
const hmac = crypto
  .createHmac('sha256', SHOPIFY_API_SECRET)
  .update(rawBody)         // raw, not parsed
  .digest('base64')        // base64, NOT hex

const ok = crypto.timingSafeEqual(
  Buffer.from(hmac, 'utf8'),
  Buffer.from(req.headers['x-shopify-hmac-sha256'], 'utf8')
)

HTTP headers are case-insensitive but some frameworks normalize them differently. Express returns headers lowercased; raw Node http.IncomingMessage preserves case. If your code reads req.headers.StripeSignature directly instead of req.headers['stripe-signature'] (lowercase), you get undefined and your verifier explodes. Multi-value headers are another gotcha — Stripe-Signature can contain comma-separated v1 entries when a secret has been rotated.

// Always read headers lowercase, defensively
const sig =
  req.headers['stripe-signature'] ||
  req.headers['Stripe-Signature']    // some proxies preserve case
if (Array.isArray(sig)) sig = sig[0] // multi-value defensive