A received webhook still needs its source verified
An application receives a notification that looks right: it has an event type, an identifier and the expected data. That does not prove who sent it. If the notification can trigger an action, checking its source is part of the process.
A specific example: Stripe signatures
Stripe’s documentation recommends verifying events received by a webhook. Its example uses the request body, the Stripe-Signature header and the endpoint secret with constructEvent(). Seeing a header with that name is not enough: it must be validated using the provider’s mechanism.
Each service has its own contract. Do not copy a Stripe header name or rule into another integration and assume it works the same way. Read the service documentation and check the library used by the application before accepting an event as verified.
The original body matters
Stripe explains that verification requires the original request body without changes. Adding whitespace, reordering properties or transforming the content before checking the signature can make validation fail.
This detail affects server configuration: some frameworks automatically parse JSON before the webhook code receives it. Check the order of components and preserve the body required for verification. Do not disable the check just to make the error disappear; separate a configuration problem from the decision to accept unverified data.
Different environments, different secrets
Another common error described by Stripe is using the secret for a different endpoint. Events forwarded through its development tool and an endpoint configured in the Dashboard do not necessarily share the same secret. Identify the environment and destination before configuring verification.
To test the flow, use official testing tools and check that an altered message does not trigger the action. Avoid exposing secrets or customer data in shared logs. A valid signature does not decide which action is appropriate either: event types and business rules still need to be checked. Receiving, verifying and acting are separate steps.