stav

[dry elk]

Hi there!

Getting a SignatureVerificationError is quite common. It usually comes from two potential errors:

• You are using the wrong webhook secret. So please double check you are using the correct one. It should look like whsec_xxx and match the one displayed in your dashboard
• The payload you pass in the constructEvent function is not the raw payload. So you need to ensure that you get the raw body of the HTTP request that Stripe sent you, without any interference by your code or framework in the middle.
  To debug this you'll need to add logging to log every value you pass to constructEvent (the payload, the secret, and the signature header) and then we can try to have a look at what part is wrong

[merry lake]

can you help me check it out? Im probably missing somthing,

thats where i get my secret

https://dashboard.stripe.com/test/webhooks/{secret}

and thats my code snippet

var json = await new StreamReader(HttpContext.Request.InputStream).ReadToEndAsync();
var stripeSignature = Request.Headers["Stripe-Signature"];
var secret = ConfigurationManager.AppSettings.Get("STRIPE_WEBHOOK_SECRET");
try
{
var stripeEvent = EventUtility.ConstructEvent(
json,
stripeSignature,
secret
);

//
//
catch (StripeException e)
{

            return new HttpStatusCodeResult(401);

}

[dry elk]

Have you done this?

To debug this you'll need to add logging to log every value you pass to constructEvent (the payload, the secret, and the signature header) and then we can try to have a look at what part is wrong

[merry lake]

yes

[dry elk]

And so? What did you see?

[merry lake]

i see i do get a signature and that my secret is currect

[dry elk]

So you triple checked that the secret match the one in your dashboard? It should look like whsec_xxx
If so, then the issue is most likely your payload. So you need to ensure that you get the raw body of the HTTP request that Stripe sent you, without any interference by your code or framework in the middle.

[merry lake]

ok , i see it start with "we_" not whsec_xxx, my bad

so where can i find the secret?

[tiny glen]

Hey! Taking over for my colleague. How are you adding the webhook endpoint ?

[merry lake]

what do you mean by adding?

[tiny glen]

Creating*

[merry lake]

using the dashboard

[tiny glen]

For example if you used the dashboard:
https://stripe.com/docs/webhooks/signatures#:~:text=Before you can verify signatures%2C you need to retrieve your endpoint’s secret from your Dashboard’s Webhooks settings. Select an endpoint that you want to obtain the secret for%2C then click the Click to reveal button.

For example when selecting a webhook:
https://dashboard.stripe.com/test/webhooks/we_1234

[merry lake]

ok got it thanks