Stripe webhook signature verification in n8n

Trigger

Stripe webhook, POST on the path /stripe

Nodes

3

Requires

Postgres

Category

Payments

From the course

Stripe and Payment Automations

Published

2026-09-10

What it does

Node by node

1. 1

   Webhook Accepts POST requests on the path stripe. Raw Body is on, so the request body arrives as a binary property named data rather than parsed JSON, which is the only form that still matches what Stripe signed.

2. 2

   Verify Stripe signature Reads the stripe-signature header, splits it into the t= timestamp and every v1= signature (there is more than one while a signing secret is being rolled), computes an HMAC-SHA256 of `${timestamp}.${rawBody}` with $env.STRIPE_WEBHOOK_SECRET, and compares each candidate using crypto.timingSafeEqual. It throws on a missing or malformed header, a missing secret, no match, or a timestamp more than 300 seconds away from now. On success it returns JSON.parse(rawBody) as the item.

3. 3

   Log event Inserts id, type, api_version, livemode, request id, created (through to_timestamp), the full event as jsonb, and currency, amount and balance_transaction read off data.object, into stripe_events. ON CONFLICT (id) DO NOTHING makes a redelivery a no-op. This node is disabled in the export.

Setup after import

1. 1

   Create a Postgres credential and select it on the Log event node. The export ships with the credential id set to REPLACE_ME so n8n asks you to pick your own.

2. 2

   Create the stripe_events table before you enable that node. The insert needs id as the primary key plus type, api_version, livemode, request_id, created, data (jsonb), currency, amount_cents and balance_transaction.

3. 3

   Set STRIPE_WEBHOOK_SECRET in the n8n environment. The Code node reads it through $env and throws a readable error if it cannot see it.

4. 4

   Copy the production webhook URL n8n shows for the path stripe, add it as an endpoint in the Stripe dashboard, and paste that endpoint signing secret into STRIPE_WEBHOOK_SECRET. The secret belongs to the endpoint, not to the account.

5. 5

   Enable the Log event node once the table exists.

Limits

• Verification and logging only. No event routing and no business logic.

• The Webhook node sets no response mode, so n8n acknowledges the request before the Code node runs. A failed check shows as a failed execution in n8n, not as an error response to Stripe.

• The five minute timestamp tolerance is hardcoded in the Code node.

• Idempotency goes no further than ON CONFLICT (id) DO NOTHING on the event id.

More templates