Home/Wiki Errors/Vibe Coding
Vibe Coding / Payments

Stripe webhook signature missing or not verified

The app trusts webhook JSON before verifying Stripe-Signature against the raw body.

Error text / 报错原文

  • Stripe webhook signature missing
  • No signatures found matching the expected signature
  • webhook signature verification failed

What it means

The app trusts webhook JSON before verifying Stripe-Signature against the raw body.

Most common causes

  • Body parser consumes raw body
  • Wrong webhook secret
  • Preview endpoint secret reused in production
  • AI generated code updates paid state from client

Fastest fix

  • Reproduce the smallest failing case.
  • Check environment, platform, and production settings.
  • Use the related local tool to classify the issue.
  • Fix the highest-risk security or data issue first.

Safe fix

  • Keep secrets out of client code and logs.
  • Prefer least privilege and explicit allowlists.
  • Add a regression test or checklist before retrying.
  • Document the working production configuration.

What not to do

  • Do not disable security controls as a permanent fix.
  • Do not paste secrets into public issue trackers or AI chats.
  • Do not trust preview success as production readiness.

Diagnostic commands

npm run build
git diff --check
grep -R "SERVICE_ROLE\|STRIPE_SECRET\|SUPABASE" .

Related tools

Related errors

Sources