Trace where the body changes
For Stripe, verification requires the unchanged raw request body. A parsed object that looks identical is not the same byte sequence. Keep raw input available until the supported verifier has checked it; do not log secret values.
| Stage | Value or observation | Decision |
|---|---|---|
| Ingress | {"id":"EV-11","value":1} | Capture exact bytes |
| Parsed then re-encoded | {"value":1,"id":"EV-11"} | Do not verify this replacement body |
| Verifier configuration | Correct endpoint and environment reference | Resolve wrong-secret configuration privately |
Retest the original request path
Compare the body before and after middleware in a controlled synthetic test. If raw bytes match, inspect header parsing and the endpoint/environment configuration. A failed check must not create a business record while the cause is investigated.
Can sorting JSON keys repair a signature mismatch?
Show the worked answer
No. Verification applies to the sender’s original bytes. Preserve them and correct the handling path; canonicalisation is valid only if the actual signing protocol explicitly requires it.