Next.js raw-body audit

Find the exact reason a Lemon Squeezy webhook signature fails in Next.js.

Score a Next.js App Router webhook route before real payments hit it. The audit checks raw-body handling, `x-signature` verification, runtime choice, secret isolation, idempotency, duplicate replay, and PR evidence without sending code or secrets to a server.

Route inputs

Browser-only audit controls

Route path Next.js runtime Body read pattern Signature header Route notes or pasted snippet (optional)

Uses timing-safe comparison Has process-once idempotency key Has duplicate replay regression test Webhook secret only lives in env Has changed-body or wrong-secret fixture Has PR-ready launch evidence

Use fake payloads and throwaway signing secrets only. Do not paste production keys, customer data, or private order payloads.

Audit output

Score, blockers, fix order, and starter route

82 Review before launch

Primary risk Missing replay evidence

The route reads the raw body first, but duplicate delivery has not been proven yet.

Next action Add replay fixture

Run the same signed fake Lemon Squeezy event more than once and assert one side effect.

Generated report

Raw-body-safe starter route

Free tool Next.js webhook handler generator

Generate a fuller App Router handler and replay test scaffold.

Debug route Signature mismatch debugger

Compare raw body mutation, wrong secret, header format, and parser causes.

Buyer proof Pro sample report

Preview the PR-ready evidence the CN¥69 Pro Kit is built to produce.

CN¥69 kit Pro Kit preview

Inspect package contents, tests, checksum, delivery policy, and public manifest.