Express 5 + Stripe webhook signature verification: working versions (tested 2026-10-15)

{
  "name": "express-stripe-webhook",
  "private": true,
  "type": "module",
  "scripts": {
    "test": "node --import tsx --test test/*.test.ts"
  },
  "dependencies": {
    "express": "5.3.0",
    "stripe": "23.0.0"
  },
  "devDependencies": {
    "tsx": "4.23.15",
    "@types/node": "24.19.2",
    "supertest": "7.3.1",
    "@types/supertest": "7.2.1",
    "@types/express": "5.0.6"
  }
}

import express from "express";
import Stripe from "stripe";

export function createApp(stripe: Stripe, secret: string, onEvent: (e: Stripe.Event) => void) {
  const app = express();
  // Stripe needs the exact raw bytes, so use express.raw on this route only.
  app.post("/webhooks/stripe", express.raw({ type: "application/json" }), (req, res) => {
    const sig = req.header("stripe-signature");
    if (!sig) return res.status(400).json({ error: "missing_signature" });
    let event: Stripe.Event;
    try {
      event = stripe.webhooks.constructEvent(req.body, sig, secret);
    } catch {
      return res.status(400).json({ error: "bad_signature" });
    }
    onEvent(event);
    res.json({ received: true, type: event.type });
  });
  app.use(express.json());
  return app;
}

import { test } from "node:test";
import assert from "node:assert/strict";
import request from "supertest";
import Stripe from "stripe";
import { createApp } from "../src/app.ts";

const stripe = new Stripe("sk_test_dummy");
const secret = "whsec_test_secret";
const payload = JSON.stringify({ id: "evt_1", object: "event", type: "checkout.session.completed", data: { object: { id: "cs_1" } } });

test("accepts a correctly signed event", async () => {
  const seen: string[] = [];
  const header = stripe.webhooks.generateTestHeaderString({ payload, secret });
  const res = await request(createApp(stripe, secret, (e) => seen.push(e.type)))
    .post("/webhooks/stripe").set("content-type", "application/json").set("stripe-signature", header).send(payload);
  assert.equal(res.status, 200);
  assert.deepEqual(seen, ["checkout.session.completed"]);
});

test("rejects a bad signature", async () => {
  const header = stripe.webhooks.generateTestHeaderString({ payload, secret: "whsec_wrong" });
  const res = await request(createApp(stripe, secret, () => {}))
    .post("/webhooks/stripe").set("content-type", "application/json").set("stripe-signature", header).send(payload);
  assert.equal(res.status, 400);
});

test("rejects a missing signature", async () => {
  const res = await request(createApp(stripe, secret, () => {})).post("/webhooks/stripe").set("content-type", "application/json").send(payload);
  assert.equal(res.status, 400);
});