School · Module 3 · Lesson 2 of 4
Verify every webhook signature
An unsigned webhook endpoint is an open door to grant yourself a lifetime plan.
Stripe signs each webhook with your endpoint's whsec_ secret. Verify it with stripe.webhooks.constructEvent (or the equivalent) against the raw request body before you trust the event.
Use the raw body, not a re-serialised JSON object. Many frameworks parse JSON before your handler runs; disable that for the webhook route.
Each endpoint and mode (test vs live) has its own secret. Do not reuse one secret across both.