#bmizerany1234
livid cove
summer canopy
Hello! I don't think there are special considerations for Stripe Apps when it comes to webhooks. Can you tell me more about what you've tried and what's not working?
night jolt
Yes
With the raw payload as it comes in on the wire, the Stripe-Signature header, and the webhook secret I get from stripe listen ...
I get an error saying it doesn't work
summer canopy
It's very likely the raw body is being altered before it reaches that function. It's common for middleware or other code to modify it. Can you check for anything that could potentially be doing that?
summer canopy
The only other explanation is that you're using the wrong secret, but that seems unlikely since you're using the CLI and copying and pasting the one it's providing. Can you confirm the copy and paste didn't miss a character, or include extras?
night jolt
I'm perplexed as to how this "event" is actualyl going through the Stripe event queue/system
It's literally making a raw fetch request to localhost:4242 using the fetchWhateverSignatureThing()
one sec
summer canopy
What is "it"?
night jolt
The Stripe Extension App
that is right out of an example
from stripe
it says to add that header, then use the backend SDK to verify
summer canopy
You're asking about fetchStripeSignature()?
night jolt
I'm asking about how to verify on the backend that the signature I get in Stripe-Signature was in fact something that come from fetchStripeSignature() which came form the Stripe Ext App SDK
more context:
summer canopy
You said, "that is right out of an example." Can you point me to the example?
night jolt
summer canopy
Oh, okay, so this isn't really about webhooks, this is about authenticated signed requests from your Stripe App to your backend. Have you done Step #3 here to get the signing secret? https://stripe.com/docs/stripe-apps/build-backend#before-you-begin
night jolt
yeah
it says run stripe listen
I did. It spits out a secret
I think I may see the problem
summer canopy
Sorry, not sure I'm following. You did this and it led you somewhere that says to run stripe listen?
night jolt
Ah
All this talk about webhooks and the code using a function called "webhook.verify" had me going down the wrong path
summer canopy
Did the signature from the details page work?