A request arrives saying that an order has been paid. Its JSON contains the expected fields, so the application marks the order complete. The missing question is who sent that request. A familiar data shape does not establish authenticity.
A webhook endpoint is an entry point into your application. Before using an event to change an order, follow the sending service’s documented verification process. Do not treat a secret-looking endpoint URL as a substitute for that process.
Keep the material the signature actually covers
Stripe’s webhook guidance explains signature verification using the request body, signature header and endpoint secret. Its verification requires the raw request body. Parsing JSON and then serialising it again can change the bytes, even when the resulting object appears equivalent.
Check where your framework’s body parser runs. The route should preserve the original payload for the supported verification library. Confirm that the signing secret belongs to this endpoint and environment; a local test listener and a deployed endpoint may use different secrets.
Test the refusal path
- Send a valid test event and confirm the expected result.
- Change the payload after signing and confirm it is rejected.
- Test a missing signature and the wrong endpoint secret.
- Verify that rejected requests cause no order changes.
Use the provider’s test facilities and supported library rather than inventing a signing scheme. Keep secrets out of logs and source control. Log enough non-sensitive information to investigate a failure without copying an entire payment payload into a general error report.
Signature validation is only the first gate. Afterwards, confirm that the event type is relevant and that its identifiers belong to the expected account and order. Handle duplicate delivery and event ordering according to the provider’s contract.
A successful test demonstrates more than a green response: trusted events reach the intended handler, and an altered request leaves the order untouched. Recheck that behaviour when changing middleware or framework configuration.