How to Verify Paddle Billing Webhook Signatures (and the Raw-Body Bug That Breaks Them)

Short summary

Paddle Billing webhook signatures fail when developers verify against re-serialized JSON instead of the raw request bytes—whitespace and key order changes invalidate the HMAC. The signature header contains a timestamp and digest; sign the string `${ts}:${rawBody}` with your notification secret using HMAC-SHA256. Always extract the raw body before parsing JSON; Express requires `express.raw()` and Next.js Route Handlers use `await req.text()`.

• •Webhook verification fails when signing re-serialized JSON instead of raw request bytes
• •Paddle Billing uses HMAC-SHA256 over `timestamp:rawBody` with a per-destination secret
• •Always extract raw body before parsing; frameworks require `express.raw()` (Express) or `await req.text()` (Next.js)

Generated with AI, which can make mistakes.