weismann-webhook-signing

[arctic needle]

Can you share more details on what is failing exactly?

[kindred glade]

weismann-webhook-signing

[sick imp]

the function used to validate webhook signature

No signatures found matching the expected signature for payload. Are you passing the raw request body you received from Stripe?

I'm testing with stripe CLI tool

[thorn ridge]

Hi 👋

That looks like a standard signature mismatch. What stripe client library are you using?

[sick imp]

im using esm for stripe-node which https://esm.sh/stripe?target=deno

I've verified my webhook secret multiple times

[thorn ridge]

What does your webhook signature verification code look like?

[sick imp]

whsec_

[thorn ridge]

Sorry, what does the actual code look like? Are you using this example?
https://stripe.com/docs/webhooks/quickstart?lang=node

[sick imp]

i'm using deno so i'm using this example
https://github.com/stripe-samples/stripe-node-deno-samples/blob/main/webhook-signing/main.js

[thorn ridge]

Okay. I'm not familiar with Deno. But you said verified the signature. I assume that means the value that is loaded in this script, not just what is stored in an .env file somewhere.

I know you likely already did this but could you log

• body
• signature
• Deno.env.get("STRIPE_WEBHOOK_SIGNING_SECRET")

and verify each of them is what you expect?

[sick imp]

Yeah, i've already verified them all and tried both bytes and string formats for body but it doesnt work

im testing right now with nodejs

for us to be on the same track

[sick imp]

i copied a part of the example on the official page, this ^^

just for curiosity sake

do i need a special webhook secret for stripe CLI...?

[thorn ridge]

You are using the stripe forward command, correct?

[sick imp]

oh god, i completly forgot the webhook secret for testing is not the same for the actual webhook

I've found the problem, thank you!

completely went over my head

[thorn ridge]

Okay great 🎉 I'm glad you were able to find it.