BillingWebhookKit

Stripe webhook signature verification in Next.js

Next.js teams often lose Stripe signature verification when a route parses JSON before checking the raw request body.

Open the free generator

Read the raw body first

In an App Router webhook route, read await request.text() and pass that exact string into signature verification before calling JSON.parse.

Keep signed Stripe fixtures

Store fake checkout.session.completed and invoice.paid payloads with test Stripe-Signature headers so CI protects the raw-body behavior.

Replay duplicates safely

Run the same signed event multiple times and assert that access grants, subscription updates, invoices, and emails happen once.

Separate provider verification

Verify Stripe's signature before normalizing the event into your internal billing model, just as you would keep Lemon Squeezy, Paddle, and Polar verification separate.

FAQ

Why does Stripe webhook verification fail in Next.js?

The common cause is parsing or reserializing the request body before verification. The HMAC must be computed from the exact raw body that Stripe signed.

Do local Stripe signature tests need a live Stripe account?

No. You can use fake JSON fixtures and fake signing secrets for route tests, then run a separate provider checkout smoke test before production launch.

Use the free sample before wiring production checkout

Download a public sample pack with fake Lemon Squeezy fixtures, signature tests, contract checks, duplicate replay tests, and CI skeletons. The Pro Kit preview shows the full paid package structure without exposing the private archive.