stripe webhook signature verification nextjs app router raw body

constructEvent needs the exact bytes, not re-serialized JSON

Stripe's signature check is computed over the raw request body -- parsing it to JSON first and re-serializing breaks verification in a way that's easy to miss (D3).

This is one of the things SaaS Billing + Tax Core already handles. Charge per-seat subscriptions: upgrades, downgrades, failed cards, invoices and sales tax.

Buy for $1493 of 3 clean-room builds passed · full refund if it fails on your machine

Is this you?

Stripe's webhook signature is computed over the exact raw bytes of the request body. A route handler that calls request.json() first (to inspect the event) and then passes the re-serialized object to constructEvent() will fail signature verification intermittently or always, depending on whitespace and key-order differences introduced by re-serialization -- and the failure looks like a configuration problem, not a code-order problem.

Why this one is easy to get wrong

Reading the body as JSON first is the natural instinct for any handler that needs to inspect a webhook's event type before deciding what to do -- and in a framework with an automatic body parser, there's often no other obvious way to get the payload. Next.js App Router route handlers hand you a Web-standard Request specifically so this isn't necessary, but that only helps if the handler is written to take advantage of it.

What you get instead

D3 pins the order explicitly: await req.text() before any JSON parsing, so constructEvent() gets the exact bytes Stripe signed. A missing or invalid stripe-signature header returns 400; a handler exception returns 500 so Stripe retries; everything else -- including event types the app doesn't handle -- returns 200, because Stripe disables an endpoint after enough non-2xx responses.

Source: ARCHITECTURE.md D3 — checkable in the pack you receive

How you actually use this

You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.

Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.

Typical build: about 18 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.

Why you can believe this

3 of 3 runs passed

We ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →

Buy for $149 14-day refund if verify.sh fails →