Why JSON Body Parsers Break Stripe and Shopify Webhook HMAC Signature Checks

A common cause of 401 Unauthorized errors in Node and TypeScript webhook handlers is checking the HMAC-SHA256 signature against a re-serialized JSON body rather than the original bytes. Once a global JSON parser has deserialized and reserialized a payload, changes in key spacing, escaped characters, or number formatting can yield a different digest. The article provides a sample Stripe verification function that works on the raw UTF-8 body buffer, combines it with the timestamp, and enforces a replay-protection tolerance window. It also uses a constant-time comparison to guard against timing attacks. The piece points to a companion engineering guide and an interactive signature tester for further study.