Stripe and Shopify Webhook HMAC-SHA256 Verification: Why JSON Body Parsers Break Raw-Body Signatures

The most frequent cause of 401 Unauthorized webhook failures in Node and TypeScript backends is verifying the HMAC-SHA256 signature against JSON.stringify(req.body) instead of the exact raw UTF-8 byte stream transmitted by Stripe or Shopify.

Whenever a global JSON body parser deserializes and re-serializes a payload, subtle differences in key spacing, escaped characters, or scientific notation produce a completely different SHA-256 digest.

import crypto from 'node:crypto';

export function verifyStripeWebhookRawHmac({ rawBodyBuffer, sigHeader, secret, nowSec, toleranceSec = 300 }) {
  const parts = Object.fromEntries(
    String(sigHeader || '').split(',').map((kv) => kv.trim().split('='))
  );
  const ts = Number(parts.t);
  if (!Number.isInteger(ts) || Math.abs(nowSec - ts) > toleranceSec) return false;
  const signedPayload = `${ts}.${rawBodyBuffer.toString('utf8')}`;
  const expected = crypto.createHmac('sha256', secret).update(signedPayload, 'utf8').digest();
  const provided = Buffer.from(String(parts.v1 || ''), 'hex');
  return expected.length === provided.length && crypto.timingSafeEqual(expected, provided);
}

• Engineering deep-dive: Stripe & Shopify Webhook HMAC Raw-Body Pitfalls
• Interactive sandbox: Free Stripe & Shopify Webhook HMAC Signature Tester