Paddle Webhook Signature validation always shows invalid

[pushkarsingh32]

I am working in nextjs. Have tried to use this library & tried using directly using your code inline inside api folder but somehow computerHmac is always different.

import { createHmac } from 'crypto';
import { NextResponse } from 'next/server';
// import { parseWebhookBody } from "paddle-billing/webhooks";

export async function POST(request) {
    const secret = process.env.PADDLE_WEBHOOK_SECRET;

    const signature = request.headers.get('paddle-signature');
    if (!signature || typeof signature !== 'string') {
        return NextResponse.JSON({ error: 'No signature' }, { status: 401 });
    }
    // parse the webhook 
    const webhookData = request.body;
    console.log(`webhookData: ${JSON.stringify(webhookData)}`);
    const webhook = parseWebhookBody(null, secret, signature, await request.body.toString());

    console.log(`\nparsed webhook: ${JSON.stringify(webhook)}`);
    if (!webhook) {
        return NextResponse.json({ error: 'Bad Request' }, { status: 400 });
    }

    return NextResponse.json({ response: 'OK from Semantic Pen' }, { status: 200 });
}


export function parseWebhookBody(_client, secret, signature, body) {
    const captures = signature.match(/^ts=(\d+);h1=(.+)$/);
    console.log(`captures: ${captures}`);
    if (!captures) return null;

    const [_, ts, h1] = captures;
    const computedHmac = createHmac("sha256", secret)
        .update(ts + ":" + body)
        .digest("hex");

    if (computedHmac === h1) return JSON.parse(body);
    console.log(`computedHmac: ${computedHmac}`);
    return null;
}

[kossnocorp]

The problem is this code, you have to use the raw body exactly as Paddle has sent it to you, otherwise it will never pass.

await request.body.toString()

[kossnocorp]

Here, I found a related issue in the Next repo: vercel/next.js#60002

I use Next.js myself but process Paddle webhooks on Firebase Functions where I have request.rawBody.toString(). I hope you'll find a solution, and if you don't mind, please share it in the issue.

I'm closing it, as there's nothing actionable for me.

[pushkarsingh32]

We probably need to assemble the response stream of paddle before validating

here is the code that is working

`export async function POST(request) {

const paddleEnvironment = process.env.NEXT_PUBLIC_PADDLE_SANDBOX === "true" ? "sandbox" : "production";
// const secret = process.env.PADDLE_WEBHOOK_SECRET;
const secret = paddleEnvironment === "sandbox" ? process.env.PADDLE_SANDBOX_WEBHOOK_SECRET : process.env.PADDLE_WEBHOOK_SECRET;
const signature = request.headers.get('paddle-signature');
console.log(`secret: ${secret}`);
console.log(`signature: ${signature}`);
if (!signature || typeof signature !== 'string') {
    return NextResponse.JSON({ error: 'No signature' }, { status: 401 });
}

const events = new WebhookEvents(signature, secret);
const buf = await WebhookEvents.buffer(request.body);
const event = events.constructEvent(buf);
console.log(`event: ${JSON.stringify(event)}`);

return NextResponse.json({ response: 'OK from Semantic Pen' }, { status: 200 });

}`

& for WebhookEvents

`import crypto from 'crypto';
import { Readable } from 'stream';

export const signatureHeader = 'paddle-signature';

class WebhookEvents {
constructor(signature, webhookSecret) {
if (!webhookSecret) throw new Error('No Paddle webhook secret set!');
this.signature = signature;
this.webhookSecret = webhookSecret;
}

static async buffer(readable) {
    const chunks = [];
    for await (const chunk of readable) {
        chunks.push(typeof chunk === 'string' ? Buffer.from(chunk) : chunk);
    }
    return Buffer.concat(chunks);
}

extractHeaderElements(header) {
    const parts = header.split(';');
    if (parts.length !== 2) {
        throw new Error('Incompatible header format');
    }
    const tsPart = parts.find((part) => part.startsWith('ts='));
    const h1Part = parts.find((part) => part.startsWith('h1='));

    if (!tsPart || !h1Part) {
        throw new Error('Missing ts or h1 in header');
    }

    const ts = tsPart.split('=')[1];
    const receivedH1 = h1Part.split('=')[1];

    if (!ts || !receivedH1) {
        throw new Error('Missing ts or h1 values in header');
    }

    return { ts, receivedH1 };
}

buildPayload(ts, requestBody) {
    return [ts, requestBody].join(':');
}

hashPayload(payload, secret) {
    const hmac = crypto.createHmac('sha256', secret);
    hmac.update(payload);
    return hmac.digest('hex');
}

verifyPaddleSignature(requestBody) {
    const { ts, receivedH1 } = this.extractHeaderElements(this.signature);
    const payload = this.buildPayload(ts, requestBody.toString('utf8'));
    const computedH1 = this.hashPayload(payload, this.webhookSecret);

    if (receivedH1 !== computedH1) {
        throw new Error('Invalid paddle signature');
    }
}

constructEvent(buf) {
    this.verifyPaddleSignature(buf);
    return JSON.parse(buf.toString('utf8'));
}

}

export default WebhookEvents;
`

[pbmayu]

Changing rawRequestBody to this fixed the issue for me:

const rawRequestBody = JSON.stringify(req.body);

[erenkulaksiz]

For anyone encountering this, i used backend token to verify webhook signature without luck. But, i discovered that you need to verify webhook's signature with a seperate webhook token which is available at https://sandbox-vendors.paddle.com/notifications-v2 -> edit destination -> secret key

[Andrei1524]

Changing rawRequestBody to this fixed the issue for me:

const rawRequestBody = JSON.stringify(req.body);

@pbmayu this also worked for me, TY!

[temtechie]

Okay for anyone facing issues with next js 13 pages route,

What I have done is to write a manual verifications as mentioned in the paddle webhook documentation.

Here is my code, i just verify the signature and compare it, then if it matches I allow the process to continue, if the computed signature and the signature sent by paddle does not match , i simply throw an error.

Code below:

`
import { createHmac } from "crypto";

export class PaddleSignatureVerifier {
private secretKey: string;

constructor(secretKey: string) {
    if (!secretKey) {
        throw new Error("A secret key is required to initialize PaddleSignatureHandler.");
    }
    this.secretKey = secretKey;
}

/**
 * Parse the Paddle-Signature header to extract timestamp and signature.
 * @param headerSignature - The Paddle-Signature header string.
 * @returns An object containing the timestamp and signature.
 */
parseSignatureHeader(headerSignature: string): { timestamp: string; signature: string } | null {
    if (!headerSignature) {
        return null;
    }

    const elements = headerSignature.split(";");
    const parsed: Record<string, string> = {};

    for (const element of elements) {
        const [key, value] = element.split("=").map((str) => str.trim());
        if (key && value) {
            parsed[key] = value;
        }
    }

    const timestamp = parsed["ts"];
    const signature = parsed["h1"];

    if (!timestamp || !signature) {
        return null;
    }

    return {
        timestamp,
        signature,
    };
}

/**
 * Build the signed payload by concatenating the timestamp and raw body.
 * @param timestamp - The extracted timestamp.
 * @param rawBody - The raw body of the request.
 * @returns The signed payload string.
 */
buildSignedPayload(timestamp: string | number, rawBody: string): string {
    if (!timestamp || !rawBody) {
        throw new Error("Both timestamp and raw body are required to build the signed payload.");
    }

    if (typeof rawBody !== 'string') {
        throw new Error('Raw body must be a string');
    }

    return `${timestamp}:${rawBody}`;
}

/**
 * Hash the signed payload using HMAC with SHA256 and the secret key.
 * @param signedPayload - The signed payload string.
 * @returns The HMAC-SHA256 hash as a hexadecimal string.
 */
hashSignedPayload(signedPayload: string): string {
    if (!signedPayload) {
        throw new Error("Signed payload is required to compute the hash.");
    }

    const hmac = createHmac("sha256", this.secretKey);
    hmac.update(signedPayload);
    return hmac.digest("hex");
}


/**

• Verify the Paddle-Signature header against the raw request body.

• @PARAM header - The Paddle-Signature header string.

• @PARAM rawBody - The raw body of the request.

• @returns Whether the signature is valid.
  */
  verifySignature(header: string, rawBody: string): boolean {
  const parsedHeader = this.parseSignatureHeader(header);
  if (!parsedHeader) {
  return false;
  }

   const { timestamp, signature } = parsedHeader;
   const signedPayload = this.buildSignedPayload(timestamp, rawBody);
   const computedSignature = this.hashSignedPayload(signedPayload);
  
   return computedSignature === signature;
  

  }

  /**

  • Parse the raw body to an object after verifying the signature.

  • @PARAM header - The Paddle-Signature header string.

  • @PARAM rawBody - The raw body of the request.

  • @returns The parsed object if the signature is valid.

  • @throws An error if the signature is invalid or parsing fails.
    */
    parseRawBody(header: string, rawBody: string): object {
    const isValid = this.verifySignature(header, rawBody);
    if (!isValid) {
    throw new Error("Invalid signature. The raw body cannot be trusted.");
    }

    try {
    return JSON.parse(rawBody);
    } catch (error) {
    throw new Error("Failed to parse the raw body. Ensure it is a valid JSON string.");
    }
    }
    }
    `

#usage

`
const secretKey = process.env['PADDLE_WEBHOOK_SECRET_KEY'] || '';
const signature = (req.headers['paddle-signature'] as string) || '';
const rawRequestBody = JSON.stringify(req.body);

const signatureVerifierHandler = new PaddleSignatureVerifier(secretKey);

const parsedHeaderSignature = signatureVerifierHandler.parseSignatureHeader(signature)

try {

    if (parsedHeaderSignature) {
        const eventData = signatureVerifierHandler.parseRawBody(signature, rawRequestBody) as any;
        switch (eventData?.event_type) {
            case EventName.SubscriptionCreated:
                await handleSubscriptionCreated(eventData);
                break;
            case EventName.SubscriptionCanceled:
                break;
            case EventName.SubscriptionUpdated:
                break;
            case EventName.TransactionPaid:
                break;
            default:
                console.log(eventData.event_type);
        }
    }
} catch (error) {
    console.log(error)
}
res.send('Processed webhook event');

`

[temtechie]

I tried everything and it didnt work for me in my next js 13 pages route, then i had to write a manual verification to handle the signature verification.

[johnson-52197]

Okay for anyone facing issues with next js 13 pages route,

What I have done is to write a manual verifications as mentioned in the paddle webhook documentation.

Here is my code, i just verify the signature and compare it, then if it matches I allow the process to continue, if the computed signature and the signature sent by paddle does not match , i simply throw an error.

Code below:

` import { createHmac } from "crypto";

export class PaddleSignatureVerifier { private secretKey: string;

constructor(secretKey: string) {
    if (!secretKey) {
        throw new Error("A secret key is required to initialize PaddleSignatureHandler.");
    }
    this.secretKey = secretKey;
}

/**
 * Parse the Paddle-Signature header to extract timestamp and signature.
 * @param headerSignature - The Paddle-Signature header string.
 * @returns An object containing the timestamp and signature.
 */
parseSignatureHeader(headerSignature: string): { timestamp: string; signature: string } | null {
    if (!headerSignature) {
        return null;
    }

    const elements = headerSignature.split(";");
    const parsed: Record<string, string> = {};

    for (const element of elements) {
        const [key, value] = element.split("=").map((str) => str.trim());
        if (key && value) {
            parsed[key] = value;
        }
    }

    const timestamp = parsed["ts"];
    const signature = parsed["h1"];

    if (!timestamp || !signature) {
        return null;
    }

    return {
        timestamp,
        signature,
    };
}

/**
 * Build the signed payload by concatenating the timestamp and raw body.
 * @param timestamp - The extracted timestamp.
 * @param rawBody - The raw body of the request.
 * @returns The signed payload string.
 */
buildSignedPayload(timestamp: string | number, rawBody: string): string {
    if (!timestamp || !rawBody) {
        throw new Error("Both timestamp and raw body are required to build the signed payload.");
    }

    if (typeof rawBody !== 'string') {
        throw new Error('Raw body must be a string');
    }

    return `${timestamp}:${rawBody}`;
}

/**
 * Hash the signed payload using HMAC with SHA256 and the secret key.
 * @param signedPayload - The signed payload string.
 * @returns The HMAC-SHA256 hash as a hexadecimal string.
 */
hashSignedPayload(signedPayload: string): string {
    if (!signedPayload) {
        throw new Error("Signed payload is required to compute the hash.");
    }

    const hmac = createHmac("sha256", this.secretKey);
    hmac.update(signedPayload);
    return hmac.digest("hex");
}


/**

• Verify the Paddle-Signature header against the raw request body.

• @PARAM header - The Paddle-Signature header string.

• @PARAM rawBody - The raw body of the request.

• @returns Whether the signature is valid.
  */
  verifySignature(header: string, rawBody: string): boolean {
  const parsedHeader = this.parseSignatureHeader(header);
  if (!parsedHeader) {
  return false;
  }

   const { timestamp, signature } = parsedHeader;
   const signedPayload = this.buildSignedPayload(timestamp, rawBody);
   const computedSignature = this.hashSignedPayload(signedPayload);
  
   return computedSignature === signature;
  

  }
  /**

  • Parse the raw body to an object after verifying the signature.
  • @PARAM header - The Paddle-Signature header string.
  • @PARAM rawBody - The raw body of the request.
  • @returns The parsed object if the signature is valid.
  • @throws An error if the signature is invalid or parsing fails.
    */
    parseRawBody(header: string, rawBody: string): object {
    const isValid = this.verifySignature(header, rawBody);
    if (!isValid) {
    throw new Error("Invalid signature. The raw body cannot be trusted.");
    }
    try {
    return JSON.parse(rawBody);
    } catch (error) {
    throw new Error("Failed to parse the raw body. Ensure it is a valid JSON string.");
    }
    }
    }
    `

#usage

` const secretKey = process.env['PADDLE_WEBHOOK_SECRET_KEY'] || ''; const signature = (req.headers['paddle-signature'] as string) || ''; const rawRequestBody = JSON.stringify(req.body);

const signatureVerifierHandler = new PaddleSignatureVerifier(secretKey);

const parsedHeaderSignature = signatureVerifierHandler.parseSignatureHeader(signature)

try {

    if (parsedHeaderSignature) {
        const eventData = signatureVerifierHandler.parseRawBody(signature, rawRequestBody) as any;
        switch (eventData?.event_type) {
            case EventName.SubscriptionCreated:
                await handleSubscriptionCreated(eventData);
                break;
            case EventName.SubscriptionCanceled:
                break;
            case EventName.SubscriptionUpdated:
                break;
            case EventName.TransactionPaid:
                break;
            default:
                console.log(eventData.event_type);
        }
    }
} catch (error) {
    console.log(error)
}
res.send('Processed webhook event');

`

This worked for me!!! Thank you so much!

[johnson-52197]

For anyone using python sdk here is the equivalent python code for manual verification written by @temtechie

import hmac
import hashlib
from typing import Optional, Dict, Tuple

class PaddleSignatureVerifier:
    def __init__(self, secret_key: str):
        if not secret_key:
            raise ValueError("A secret key is required to initialize PaddleSignatureHandler.")
        self.secret_key = secret_key

    def parse_signature_header(self, header_signature: str) -> Optional[Dict[str, str]]:
        """Parse the Paddle-Signature header to extract timestamp and signature."""
        if not header_signature:
            return None

        elements = header_signature.split(";")
        parsed = {}

        for element in elements:
            key_value = element.strip().split("=", 1)
            if len(key_value) == 2:
                key, value = key_value
                parsed[key.strip()] = value.strip()

        timestamp = parsed.get("ts")
        signature = parsed.get("h1")

        if not timestamp or not signature:
            return None

        return {
            "timestamp": timestamp,
            "signature": signature
        }

    def build_signed_payload(self, timestamp: str, raw_body: str) -> str:
        """Build the signed payload by concatenating the timestamp and raw body."""
        if not timestamp or not raw_body:
            raise ValueError("Both timestamp and raw body are required to build the signed payload.")

        if not isinstance(raw_body, str):
            raise ValueError("Raw body must be a string")

        return f"{timestamp}:{raw_body}"

    def hash_signed_payload(self, signed_payload: str) -> str:
        """Hash the signed payload using HMAC with SHA256 and the secret key."""
        if not signed_payload:
            raise ValueError("Signed payload is required to compute the hash.")

        hmac_obj = hmac.new(
            self.secret_key.encode('utf-8'),
            signed_payload.encode('utf-8'),
            hashlib.sha256
        )
        return hmac_obj.hexdigest()

    def verify_signature(self, header: str, raw_body: str) -> bool:
        """Verify the Paddle-Signature header against the raw request body."""
        parsed_header = self.parse_signature_header(header)
        if not parsed_header:
            return False

        timestamp = parsed_header["timestamp"]
        signature = parsed_header["signature"]
        signed_payload = self.build_signed_payload(timestamp, raw_body)
        computed_signature = self.hash_signed_payload(signed_payload)

        return computed_signature == signature

    def parse_raw_body(self, header: str, raw_body: str) -> dict:
        """Parse the raw body to a dict after verifying the signature."""
        is_valid = self.verify_signature(header, raw_body)
        if not is_valid:
            raise ValueError("Invalid signature. The raw body cannot be trusted.")

        try:
            return json.loads(raw_body)
        except json.JSONDecodeError:
            raise ValueError("Failed to parse the raw body. Ensure it is a valid JSON string.")


@router.post("/webhook")
async def handle_webhook(request: Request):
    try:
        # Get the raw body and signature
        raw_body = await request.body()
        body_str = raw_body.decode("utf-8")
        paddle_signature = request.headers.get("paddle-signature")
        
        if not paddle_signature:
            log.error("Paddle signature missing in header")
            raise HTTPException(
                status_code=400, detail="Missing paddle-signature header"
            )

        # Verify the signature
        webhook_secret = os.getenv("PADDLE_WEBHOOK_SECRET")
        verifier = PaddleSignatureVerifier(webhook_secret)
        
        try:
            event_data = verifier.parse_raw_body(paddle_signature, body_str)
            log.info(f"Received webhook event: {event_data}")
        except ValueError as e:
            log.error(f"Signature verification failed: {str(e)}")
            raise HTTPException(status_code=401, detail="Invalid webhook signature")

        event_handlers = {
            "subscription.updated": handle_subscription_update,
            "subscription.canceled": handle_subscription_cancellation,
            "subscription.payment_succeeded": handle_payment_success,
            "subscription.payment_failed": handle_payment_failure,
        }

        event_type = event_data.get("event_type")
        if event_type not in event_handlers:
            log.warning(f"Unhandled webhook event type: {event_type}")
            return {"received": True, "handled": False}

        try:
            await event_handlers[event_type](event_data.get("data", {}))
            log.info(f"Successfully processed webhook event: {event_type}")
            return {"received": True, "handled": True}
        except Exception as handler_error:
            log.error(
                f"Error in webhook handler for {event_type}: {str(handler_error)}"
            )
            raise HTTPException(
                status_code=500, detail=f"Webhook handler failed: {str(handler_error)}"
            )

    except json.JSONDecodeError as e:
        log.error(f"Invalid JSON in webhook request: {str(e)}")
        raise HTTPException(status_code=400, detail="Invalid JSON payload")
    except Exception as e:
        log.error(f"Webhook processing failed: {str(e)}")
        raise HTTPException(
            status_code=500, detail=f"Webhook processing failed: {str(e)}"
        )

[kulakowka]

Try deleting your current webhook and creating a new one here: https://sandbox-vendors.paddle.com/notifications-v2
Once created, open the created webhook and copy the secret key from there.
It helped me.

Here is a full example of my code:

import { HttpsError } from "firebase-functions/v2/https";
import * as logger from "firebase-functions/logger";
import { defineString } from "firebase-functions/params";
import express, { Router, Request, Response } from "express";
import {
  Paddle,
  EventName,
  Environment,
  LogLevel,
} from "@paddle/paddle-node-sdk";

const apiKey = defineString("PADDLE_API_KEY");
const webhookSecret = defineString("PADDLE_WEBHOOK_SECRET_KEY");

const router = Router();

router.post(
  "/",
  express.raw({ type: "application/json" }),
  (req: Request, res: Response) => {
    const signature = req.headers["paddle-signature"] as string;

    const rawRequestBody = JSON.stringify(req.body);

    const secretKey = webhookSecret.value();

    if (!signature) {
      throw new HttpsError("invalid-argument", "Signature missing in header");
    }

    if (!rawRequestBody) {
      throw new HttpsError("invalid-argument", "Request body missing");
    }

    const paddle = new Paddle(apiKey.value(), {
      environment:
        process.env.NODE_ENV === "production"
          ? Environment.production
          : Environment.sandbox,
      logLevel: LogLevel.verbose,
    });

    paddle.webhooks
      .unmarshal(rawRequestBody, secretKey, signature)
      .then((eventData) => {
        switch (eventData.eventType) {
          case EventName.ProductUpdated:
            logger.info(`Product ${eventData.data.id} was updated`);

            break;
          case EventName.SubscriptionUpdated:
            logger.info(`Subscription ${eventData.data.id} was updated`);
            break;
          default:
            logger.info(eventData.eventType);
        }
      });

    // Return a response to acknowledge
    res.send("Processed webhook event");
  }
);

export default router;

[dhuyartmaker]

My code don't work. Anyone help me, please... Thank you

async webhook(@Body() body: IWebhookPaddle, @Req() req: Request) {
    try {
      const signature = (req.headers['paddle-signature'] as string) || '';
      const secretKey =
        this.configService.get<string>('PADDLE_WEBHOOK_SECRET_KEY') || 'key';

      const sigSplit = signature.split(';');
      const tsValue = sigSplit[0].split('=')[1];
      const h1Value = sigSplit[1].split('=')[1];
      const concatValue = `${tsValue}:${JSON.stringify(body)}`;

      const hashVal = createHmac('sha256', secretKey)
        .update(concatValue)
        .digest('hex');
}