How to Verify Razorpay Webhook Signatures (and Why It Is Not the Payment Signature)

Short summary

A focused technical guide on verifying Razorpay webhook signatures, clarifying the common confusion between webhook signatures (keyed with webhook secret, computed over raw body) and payment signatures (keyed with API key secret, computed over order_id|payment_id). Includes working Node.js/Express code using crypto.timingSafeEqual, and explains the raw-body trap where JSON parsing breaks HMAC verification. The same raw-body pitfall applies to Stripe, Paddle, and most webhook providers.

• •Razorpay has two separate HMAC-SHA256 signatures: webhook (webhook secret + raw body) and payment (API key secret + order_id|payment_id) — they are not interchangeable
• •Capture raw unparsed body before JSON parsing or signature verification fails due to byte-level differences
• •Use crypto.timingSafeEqual for constant-time comparison to prevent timing attacks

Generated with AI, which can make mistakes.