Fix invalid Lemon Squeezy x-signature errors
When Lemon Squeezy webhooks return invalid signature errors, teams need a fast way to isolate whether the body, secret, or header handling changed.
Open the free generatorCheck the raw body
Compare the received raw request body against the exact body used to compute the expected HMAC SHA-256 digest.
Check the endpoint secret
Make sure the webhook signing secret belongs to the same Lemon Squeezy endpoint and environment that sent the event.
Check the header value
Normalize the x-signature header carefully and reject missing, truncated, prefixed, or whitespace-damaged values.
FAQ
Can a valid event still fail signature verification?
Yes. A valid provider event fails if your framework changes the raw body before verification or if the route uses the wrong endpoint secret.
Should I log production webhook secrets while debugging?
No. Use fake secrets and fixtures in reports, and log only non-sensitive request IDs or event IDs.
Use the free sample before wiring production checkout
Download a public sample pack with fake Lemon Squeezy fixtures, signature tests, contract checks, duplicate replay tests, and CI skeletons. The Pro Kit preview shows the full paid package structure without exposing the private archive.