Verifying Webhook Signatures Securely
Protect your payment backend from forged events by validating Stripe webhook signatures and following secure endpoint practices.
Verifying Webhook Signatures Securely is a free Stripe Payments & SaaS Billing Systems lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Stripe Payments & SaaS Billing Systems learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
Why Verify Webhooks?
Your webhook endpoint is public. Without verification, an attacker could POST a fake payment_succeeded event and unlock paid features for free.
The Signing Secret
Each webhook endpoint has a signing secret (starts with whsec_). Stripe uses it to sign every event it sends you.
The Stripe-Signature Header
Every webhook request carries a Stripe-Signature header containing a timestamp and an HMAC signature of the payload.
// Stripe-Signature: t=1700000000,v1=5257a8...Use the Raw Body
Signature verification needs the exact raw request body. If a framework parses JSON first, the bytes change and verification fails.
app.post('/webhook',
express.raw({ type: 'application/json' }),
handler
);Verifying with the SDK
The Stripe SDK does the HMAC math for you via constructEvent.
function verify(rawBody, sig, secret, stripe) {
return stripe.webhooks.constructEvent(rawBody, sig, secret);
}Handling Verification Failure
If verification throws, reject the request with a 400. Never process an unverified event.
function process(ok) {
if (!ok) return { status: 400, body: 'invalid signature' };
return { status: 200, body: 'received' };
}
console.log(process(false));Timestamp Tolerance
The signature includes a timestamp. Stripe rejects events older than a tolerance window to block replay attacks with captured payloads.
Constant-Time Comparison
Under the hood, signatures are compared in constant time to avoid timing attacks. The SDK handles this; never hand-roll a simple equality check.
Respond Fast, Process Later
Acknowledge with 200 quickly, then do heavy work asynchronously. Slow responses make Stripe retry and can cause duplicates.
Keep the Secret Safe
Store the signing secret in environment variables, never in source control. Rotate it if it leaks, using the dashboard.
const secret = process.env.STRIPE_WEBHOOK_SECRET;
console.log(Boolean(secret));Per-Endpoint Secrets
Each registered endpoint has its own secret. Use the correct one for the URL receiving the event, especially across test and live modes.
Quick Check
Why must you use the raw request body for verification?
Recap
You secured your webhook endpoint:
- Verify the Stripe-Signature with the signing secret
- Use the raw body and the SDK constructEvent
- Reject failures and rely on timestamp tolerance against replays
- Keep secrets in env vars and respond fast
Frequently asked questions
Is the “Verifying Webhook Signatures Securely” lesson free?
Yes — the full text of “Verifying Webhook Signatures Securely” is free to read here on the web, and the Stripe Payments & SaaS Billing Systems course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Stripe Payments & SaaS Billing Systems course, upgrade to CoddyKit PRO.
What will I learn in “Verifying Webhook Signatures Securely”?
Protect your payment backend from forged events by validating Stripe webhook signatures and following secure endpoint practices. You practise Stripe Payments & SaaS Billing Systems with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Stripe Payments & SaaS Billing Systems?
No prior experience is required. Stripe Payments & SaaS Billing Systems on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Verifying Webhook Signatures Securely” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Stripe Payments & SaaS Billing Systems lesson?
Yes. Every Stripe Payments & SaaS Billing Systems lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Securely Storing Payment Methods (Tokens)
- Implementing Strong Customer Authentication (SCA)
- PCI Compliance Best Practices for Developers
- Verifying Webhook Signatures Securely