Stripe webhook: "No signatures found matching the expected signature for payload"

Symptom

You added Stripe Checkout to an app built with Cursor, Bolt or Lovable, with a Node/Express or Next.js backend. Payments go through, but your webhook endpoint returns 400, and your logs show one of these:

No signatures found matching the expected signature for payload. Are you passing the raw request body you received from Stripe?

Webhook payload must be provided as a string or a Buffer ... Payload was provided as a parsed JavaScript object instead.

So orders never get marked as paid.

Why it happens

• Stripe signs the exact bytes it sends. stripe.webhooks.constructEvent() needs those same, untouched bytes, plus the signing secret (whsec_...) for that endpoint.
• AI-generated servers usually add app.use(express.json()) at the top. That turns the body into an object before your webhook code sees it:
  • Passing that object gives the "must be provided as a string or a Buffer" error.
  • "Fixing" it with JSON.stringify(req.body) creates different bytes, which gives "No signatures found".
• A wrong secret gives the same "No signatures found" error (e.g. the Stripe CLI's secret instead of the dashboard endpoint's, or test vs live).

What we could not test

• Real Stripe deliveries, the Stripe CLI (stripe listen), and test vs live secrets in a real account.
• Next.js App Router and Pages Router, Vercel serverless body handling, and other frameworks.
• Proxies that rewrite the body.