Verified Developer Solution • 100% OfflineDebug "HMAC signature does not match" in Webhook verification
Learn how to correctly calculate and verify HMAC SHA-256 signatures for Stripe, GitHub, or Shopify webhooks.
Your server is rejecting legitimate incoming webhooks because the computed HMAC signature doesn't match the one sent in the headers (e.g., `x-hub-signature-256`).
This usually occurs because the request body was parsed or modified (like `JSON.parse()`) before hashing. HMAC must be calculated against the raw, unmodified byte stream of the request body.
Code Standard: Bad Pattern vs Verified Fix
Live Syntax1// ❌ Bad: Hashing parsed JSON2const hash = crypto.createHmac('sha256', secret).update(JSON.stringify(req.body)).digest('hex');3 4// ✅ Good: Hashing the raw body buffer5const hash = crypto.createHmac('sha256', secret).update(req.rawBody).digest('hex');Test and resolve this using HMAC Generator
Execute directly in your browser memory. Zero API keys, zero network tracking, completely client-side.
Frequently Asked Questions
Q:What is req.rawBody?
In frameworks like Express, you must configure the body-parser to save the raw buffer before it converts it to a JavaScript object.
Q:How can I test my secret key?
Use our HMAC Generator to manually hash your raw JSON payload with your secret and compare it to the header.