Fix Stripe webhook signature errors in Express
If Stripe's library throws "No signatures found matching the expected signature for payload", check two things first.
1. Did you verify a parsed body? Stripe signs the raw bytes it sends. If express.json() runs before your webhook route, the body is parsed and re-serialised, so the signature no longer matches. Give the webhook route its own raw parser, registered before the global JSON parser:
app.post('/webhooks/stripe', express.raw({ type: 'application/json' }), handler);
app.use(express.json());Then pass req.body (a Buffer) to stripe.webhooks.constructEvent.
2. Is it the right secret? Each endpoint has its own whsec_ secret, test and live mode differ, and stripe listen prints a different one from the Dashboard endpoint.
Webhooks Done Right (for Stripe) (US$19) teaches Claude Code and Cursor both rules, with tested reference endpoints.