Stripe webhook signature verification in Next.js
Next.js teams often lose Stripe signature verification when a route parses JSON before checking the raw request body.
Open the free generatorRead the raw body first
In an App Router webhook route, read await request.text() and pass that exact string into signature verification before calling JSON.parse.
Keep signed Stripe fixtures
Store fake checkout.session.completed and invoice.paid payloads with test Stripe-Signature headers so CI protects the raw-body behavior.
Replay duplicates safely
Run the same signed event multiple times and assert that access grants, subscription updates, invoices, and emails happen once.
Separate provider verification
Verify Stripe's signature before normalizing the event into your internal billing model, just as you would keep Lemon Squeezy, Paddle, and Polar verification separate.
FAQ
Why does Stripe webhook verification fail in Next.js?
The common cause is parsing or reserializing the request body before verification. The HMAC must be computed from the exact raw body that Stripe signed.
Do local Stripe signature tests need a live Stripe account?
No. You can use fake JSON fixtures and fake signing secrets for route tests, then run a separate provider checkout smoke test before production launch.
Use the free sample before wiring production checkout
Download a public sample pack with fake Lemon Squeezy fixtures, signature tests, contract checks, duplicate replay tests, and CI skeletons. The Pro Kit preview shows the full paid package structure without exposing the private archive.