BillingWebhookKit

Verify Lemon Squeezy webhook signatures

Webhook routes should reject forged events before they touch billing state.

Open the free generator

Read the raw body

Compute the HMAC from the exact raw request bytes, not from a parsed and reserialized JSON object.

Compare signatures safely

Use a timing-safe compare in server runtimes where it is available, and reject missing or malformed signatures.

Test failure paths

Keep fixtures for valid, invalid, missing, and stale webhook signatures so CI catches accidental verification bypasses.

FAQ

Which algorithm is used?

Lemon Squeezy webhook signing uses HMAC SHA-256.

Where should verification happen?

At the first line of your webhook route, before parsing business-specific event fields.

Use the free sample before wiring production checkout

Download a public sample pack with fake Lemon Squeezy fixtures, signature tests, contract checks, duplicate replay tests, and CI skeletons. The Pro Kit preview shows the full paid package structure without exposing the private archive.

Download free sample Inspect the public fixture, tests, review report, and workflow before buying. View Pro Kit preview Prepared as a CN¥69 digital kit; checkout stays disabled until live Lemon Squeezy configuration is connected.

Related payment webhook guides

Continue with adjacent checks before a billing route accepts paid checkout traffic.

All payment webhook guides Browse the full BillingWebhookKit guide index. Fix Invalid Lemon Squeezy x-signature Errors Debug invalid Lemon Squeezy x-signature webhook errors caused by raw-body changes, wrong secrets, header formats, and framework body parsers. Lemon Squeezy Webhook Test Checklist A launch checklist for Lemon Squeezy webhook signature verification, contract fields, idempotency keys, duplicate replay, and entitlement decisions. Test Lemon Squeezy Webhooks Locally Generate Lemon Squeezy webhook payloads, HMAC signatures, and curl replay commands without sending secrets to a server. Lemon Squeezy Webhook Raw Body in Next.js Fix Lemon Squeezy webhook signature checks in Next.js by verifying the exact raw request body before JSON parsing.