---
title: "Webhook signature verification keeps failing"
url: "https://demo.myforumcat.com/q/11/webhook-signature-verification-keeps-failing"
forum: "Demo"
question_number: 11
category: "Billing"
tags: ["Export", "Analytics"]
status: "solved"
solved: true
votes: 29
replies: 2
views: 2619
asked_at: "2026-05-08T23:34:38.534Z"
updated_at: "2026-09-18T23:17:45.189Z"
---

# Webhook signature verification keeps failing

Asked by Marcus Lee on 2026-05-08 · 29 votes

We are validating the HMAC signature against the raw body but it never matches. Are you signing the parsed JSON or the raw bytes?

## 2 replies

### Reply 1 (marked as the solution)

meow (Owner) · 2026-05-09 · 7 votes

We sign the raw request body, not the parsed JSON, so if your framework re-serializes the payload before you compute the HMAC the bytes will never match. Grab the body before any JSON.parse call and verify against that exact buffer.

### Reply 2

Margaret Doyle · 2026-05-09 · 2 votes

This was exactly our bug, grabbing the raw body before parsing fixed it immediately.