#thnkscj - webhook signature

1 messages · Page 1 of 1 (latest)

sand creek
#

Hello! Just starting a thread for you -- I'll review and respond as soon as I can 🙂

uncut narwhal
#

thanks

sand creek
#

Hey there, you need to ensure you're using the raw request body, and using the correct signing secret

#

Can you share an example event ID you're testing?

uncut narwhal
#

payment_intent.created

sand creek
#

I mean a specific event ID. Is this a hosted endpoint, local testing via CLI etc?

#

evt_123

uncut narwhal
#

its a hosted one

#

evt_3Kr6j3HanlZs58ak1X7utkqh

sand creek
#

Is there any part of your express app setup that is deserializing json before that endpoint is configured?

#

eg, using bodyparser or express.json() at some earlier stage?

#

That will mutate the request body

#

Also you should log out your secret and ensure it has the expected content: whsec_XQ...d6vs

uncut narwhal
sand creek
#

Great!

#

(just be aware it might affect other code expecting deserialized payloads)

#

You can modify express.json() to exclude certain paths for fine control

#

Or, define your webhook route first then apply express.json() after that, so it only applies to all other requests not handled by /webhooks

#

Then use request.rawBody in your webhook endpoint