Lemon Squeezy webhook raw body in Next.js
Next.js developers often break Lemon Squeezy signatures by parsing JSON before HMAC verification.
Open the free generatorRead request text first
In an App Router route handler, call await request.text() and pass that exact string into your HMAC verification helper before parsing JSON.
Parse after the signature gate
Only call JSON.parse(rawBody) after the x-signature header has been compared against the HMAC digest for the unchanged raw body.
Keep regression fixtures
Save one valid raw body, one changed-body example, and one wrong-secret example so CI catches accidental request.json() regressions.
FAQ
Why does request.json() break signatures?
It consumes and parses the request body, and any later stringification can change whitespace or key ordering, so the signed bytes no longer match.
Does this require a paid Lemon Squeezy API call?
No. Raw-body signature tests can run locally with fake fixtures and a throwaway signing secret.
Use the free sample before wiring production checkout
Download a public sample pack with fake Lemon Squeezy fixtures, signature tests, contract checks, duplicate replay tests, and CI skeletons. The Pro Kit preview shows the full paid package structure without exposing the private archive.