Stripe webhooks in Express: “Webhook payload must be provided as a string or a Buffer” and the raw body

Stripe computes the signature over the exact bytes it sent. express.json() parses the body into an object, and turning it back into a string almost never reproduces the same bytes, so verification fails.

The exact error

Webhook payload must be provided as a string or a Buffer (https://nodejs.org/api/buffer.html) instance representing the _raw_ request body.Payload was provided as a parsed JavaScript object instead.
Signature verification is impossible without access to the original signed material.

stripe-node throws this when the signature doesn't match and the body you passed isn't a string, Buffer or Uint8Array. In Express that means req.body is already a parsed object: express.json() (or bodyParser.json()) ran before your webhook route, often through a global app.use(express.json()) registered above it. Older stripe-node versions (v11.0 and earlier, tested) report the same mistake as “No signatures found matching the expected signature for payload”. If you see No webhook payload was provided. instead, req.body is undefined: no body parser ran on the route at all, so add express.raw() as below.

Fix: use express.raw on the webhook route only

// webhook route FIRST, with raw body
app.post('/webhook', express.raw({ type: 'application/json' }), handler);
// then JSON for everything else
app.use(express.json());

If you need json() globally

app.use(express.json({
  verify: (req, res, buf) => { if (req.originalUrl === '/webhook') req.rawBody = buf; }
}));
// then: stripe.webhooks.constructEvent(req.rawBody, sig, secret)

Check that req.body (or req.rawBody) is a Buffer before calling constructEvent. If it's an object, the raw body has already been lost.

The same mistake in FastAPI

Python's Stripe library doesn't raise this type error. If you verify a parsed body (a dict or Pydantic parameter, or json.dumps(await request.json())) you just get “No signatures found matching…”. Verify the raw bytes:

@app.post("/webhooks/stripe")
async def stripe_webhook(request: Request):
    payload = await request.body()            # raw bytes, not a parsed model
    event = stripe.Webhook.construct_event(payload, request.headers.get("stripe-signature"), endpoint_secret)

Full FastAPI and Django handlers: stripe.SignatureVerificationError in Python. Using Next.js? See Next.js signature errors.