"Webhook signature verification failed" (Stripe, Dodo Payments): the fix

A payment service signs every webhook it sends. Your server recomputes the signature from three things: the exact body it received, the signature header, and your endpoint's secret. If any one differs, verification fails, which is what you want for a fake request but is annoying for a real one.

The error looks like this:

Webhook signature verification failed

How to fix it

1. Use the right secret. Stripe says the most common cause is the wrong endpoint secret. A secret from stripe listen (CLI) differs from the dashboard endpoint's secret; both start with whsec_. For Dodo Payments, copy the signing secret from the endpoint's Overview tab.
2. Verify the raw body. Both services say to use the body exactly as received, before any JSON parsing. Frameworks that parse first can change spacing or key order and break the match.
3. Express: order matters. Stripe notes that express.json() must come after your webhook route, or the body is parsed too early. Dodo suggests express.raw() on the webhook route.
4. Check the headers. Stripe sends Stripe-Signature (like t=...,v1=...). Dodo sends webhook-id, webhook-signature and webhook-timestamp. Make sure your code passes them unchanged.
5. Use the official helper. Stripe's libraries offer constructEvent; Dodo's SDK offers unwrap(). Both do the check for you.
6. Answer quickly. Return a 2xx right after verifying and do heavy work after, so the sender does not retry.

What you should see

Test events from the dashboard or CLI arrive and your handler logs them as verified instead of rejecting them.

Quick questions

Can I skip verification while testing?

Dodo's docs mention an unsafe unwrap for testing only. Never ship that, because anyone could then send fake payments to your endpoint.

I rolled my secret. Why do old events fail?

Dodo keeps the old secret valid for 24 hours after rotation. After that, update your server to the new one.

Sources and date checked

• Stripe: Resolve signature verification errors: https://docs.stripe.com/webhooks/signature (checked 2026-11-01)
• Dodo Payments: Webhooks: https://docs.dodopayments.com/developer-resources/webhooks (checked 2026-11-01)

Written in our own words from the official pages above. Tool names are only references; we are not affiliated with them. Commands change between versions, so check the linked docs if something differs.