PRODUCTION GUIDE / STRIPE-WEBHOOK-SIGNATURE-NEXTJS-APP-ROUTER
Verify Stripe webhook signatures in Next.js App Router
Signature verification needs three exact inputs: untouched body bytes, Stripe-Signature, and the correct endpoint secret.
Correct route pattern
Read request.text(), get the stripe-signature header, then call stripe.webhooks.constructEvent. Return 400 when construction fails.
The common mistake
Do not call request.json() first and do not JSON.stringify the parsed object. Both alter the signed representation.
Test both modes
Test events and live events use different destinations and secrets. Store them in matching Vercel environments.
Need the tested implementation?
The Hookproof kit includes the typed router, persistent idempotency adapters, fixtures, and deployment runbook.
GET THE $29 KIT