Trouble with Stripe webhook signing in test mode

levi2 · 2025-03-12T09:28:40.100Z

Hello!

I’m trying to set up a webhook for Stripe. The message is sent fine and I can work with the data. However I can’t confirm the signature.

I’m using the method suggested in the Stripe documentation for manually checking the signature, which happens to be the same method I’m successfully using for webhooks from another vendor. This method is:

Payload = {Header t value} + “.” + {request body}
Signature = {Payload} → HMAC256 encrypted (terminology?) with {Secret}
Compare Signature with {Header v1 Value}

However the result always comes out differently when I’m sending messages from TestMode to my test environment. I’m logging all the values to a Log table I’ve created, and it’s always different. I even copied the relevant values to an online HMAC signature tool just to check it was given the same result as I get, but no luck.

Has anyone run into the same problem or are there any obvious pitfalls I’ve fallen into?

Cheers,
Levi

levi2 · 2025-03-14T13:51:20.860Z

An update: Stripe support told me that they send their JSON formatted, and Bubble is removing all whitespace, which is causing this issue. Which is to say, Bubble’s “raw body text” is not raw? Is this the case?

levi2 · 2025-03-17T09:21:08.790Z

From what I’m now reading elsewhere, this is just Bubble breaking things, they’re probably aware, and there’s no telling even if they are aware that they’re planning to fix it.

[Plugin Request] Stripe webhook verification Plugin builders

Stripe recommends the verification of all webhook messages. This is important to ensure that Stripe sent the message, not someone else. Stripe generates signatures for each message. According to Stripe documentation, the Stripe-Signature header included in each signed event contains a timestamp and one or more signatures that you must verify. The timestamp is prefixed by t= , and each signature is prefixed by a scheme . Schemes start with v , followed by an integer. Currently, the only valid li…

davidb · 2025-03-17T12:21:21.702Z

ICYMI, here’s a detailed discussion of alternative approaches.

Securing Stripe webhooks without authentication Tips

EDIT: @NigelG has commented with a feature that Bubble removed from the docs but still works. Simply append ?api_token=yourAPIToken to all of your Stripe webhook URLs. The API token is generated in the API section of the editor. Appending api_token= with a valid API token will authenticate any workflow API request as an Admin. As @dorilama points out, this is likely stored in plain text in Stripe which means if Stripe gets compromised your admin key is too. [image] Based on everything contrib…

levi2 · 2025-03-20T10:18:49.682Z

FYI I have created a Bubble feature request here, as suggested by Bubble support. If we build support for this request it might expedite it. Or not, but one can only hope.

Bubble

Suggest a Feature on the Bubble Ideaboard

Do you have an idea about how we can make Bubble better? Submit a feature idea for the Bubble product team, or browse and upvote others' ideas.