FixLoop

Stripe webhook 401 on Supabase Edge Functions

Guide · October 14, 2026

Checkout looks fine. Stripe's dashboard shows the webhook failing with 401. Your Edge Function logs are empty. That pairing is almost always the platform JWT check, not your Stripe code.

Stripe does not have a Supabase user token. If verify_jwt is on (the default), the request dies before Deno.serve runs. After that is off, you still have to verify Stripe-Signature on the raw body with constructEventAsync.

Sources: Function configuration (Stripe is the documented verify_jwt = false example), Authorization headers, Edge Function 401, Securing Edge Functions (webhook + constructEventAsync), and Stripe signature verification.

What it looks like

Stripe Workbench → the endpoint → failed deliveries. Response body is from the platform, not your return new Response:

{
  "code": 401,
  "message": "Missing authorization header"
}

Sometimes Invalid JWT / Invalid Token or Protected Header formatting. Same class of failure: verify_jwt ran, your function did not.

Telltale signs:

• Function logs have no invocation for that timestamp (no execution_id).
• The handler works when you call it yourself with Authorization: Bearer <anon key>.
• Local stripe listen plus supabase functions serve --no-verify-jwt works, production 401s.

A later, different bug: you turned JWT verification off, now Stripe shows 400 and the body is Webhook signature verification failed. That means your code ran. Jump to the signature section.

Cause: verify_jwt runs first

Every Edge Function request hits two layers (docs):

1. verify_jwt (default on). The platform inspects Authorization for a user JWT. Missing, malformed, or the wrong key → 401, handler skipped.
2. Your code. This is where Stripe's signature belongs.

Stripe POSTs to https://YOUR_PROJECT.supabase.co/functions/v1/YOUR_FUNCTION with Stripe-Signature and a JSON body. No Supabase JWT. Layer 1 always loses unless you disable it for that function.

Supabase's own config docs use a Stripe webhook as the reason to set verify_jwt = false. The auth guide then verifies the provider signature inside the handler with auth: 'none'.

Fix 1: turn off JWT verification

Do this only on the webhook function. Leave user-facing functions on.

Dashboard (fastest in Lovable)

Supabase Dashboard → Edge Functions → the webhook → detail tab → toggle JWT verification off. That is the path in the 401 troubleshooting doc (Method A).

If Lovable redeploys the function later, a dashboard-only toggle can flip back. Put it in config too.

config.toml (sticks across deploys)

In supabase/config.toml, use the function's folder name:

[functions.stripe-webhook]
verify_jwt = false

Redeploy. CLI equivalent: supabase functions deploy stripe-webhook --no-verify-jwt.

Paste this into Lovable if it keeps regenerating the function with JWT on:

Fix 2: constructEventAsync on the raw body

Once Stripe can reach the handler, verify it is actually Stripe. Deno has no sync Node crypto, so the Stripe SDK's SubtleCrypto provider is async. The official handler uses constructEventAsync, not constructEvent.

Read the body with req.text() first. Signature check is HMAC over those exact bytes. req.json() up front, or JSON.stringify of a parsed object, will fail verification (Stripe: "the raw body of the request").

import Stripe from "npm:stripe";

const stripe = new Stripe(Deno.env.get("STRIPE_SECRET_KEY")!);
const cryptoProvider = Stripe.createSubtleCryptoProvider();

Deno.serve(async function (req) {
  const signature = req.headers.get("Stripe-Signature") ?? "";
  const body = await req.text();

  let event;
  try {
    event = await stripe.webhooks.constructEventAsync(
      body,
      signature,
      Deno.env.get("STRIPE_WEBHOOK_SECRET")!,
      undefined,
      cryptoProvider
    );
  } catch (err) {
    console.error("Stripe signature verification failed:", err);
    return new Response("bad signature", { status: 400 });
  }

  // handle event.type, then acknowledge
  return new Response(JSON.stringify({ received: true }), {
    headers: { "Content-Type": "application/json" },
    status: 200,
  });
});

Same shape in the current Securing Edge Functions webhook example, wrapped with withSupabase({ auth: 'none' }). Either style is fine. The invariants are: JWT off, raw text, constructEventAsync, 400 on a bad signature, 200 after you accept the event.

Return 200 quickly. Stripe retries 4xx/5xx. Do slow work after you have verified, or enqueue it. Do not 401 on a bad signature; that looks like the JWT bug you just fixed.

Secrets

• STRIPE_WEBHOOK_SECRET is the endpoint signing secret from Stripe Workbench → Webhooks → Reveal secret. It starts with whsec_.
• The secret printed by stripe listen is a different whsec_. Do not verify Dashboard deliveries with the CLI secret, or the other way around.
• Live mode and test mode each have their own secret.
• Store both STRIPE_SECRET_KEY and STRIPE_WEBHOOK_SECRET as Edge Function secrets, not VITE_ / NEXT_PUBLIC_ env in the Lovable client.

Quick checklist

• Read the 401 body. Missing authorization header / Invalid JWT → JWT check. Empty body or your own message → your code returned 401.
• Set verify_jwt = false for that function only. Redeploy.
• Confirm Stripe's URL is https://YOUR_PROJECT.supabase.co/functions/v1/YOUR_FUNCTION.
• const body = await req.text(), then constructEventAsync(body, signature, secret, undefined, cryptoProvider).
• Do not req.json() before verification. Do not call sync constructEvent() on Deno.
• 400 on a bad signature, 200 when you have accepted the event.
• Use the Dashboard whsec_ in production, the CLI secret only with stripe listen.

Questions

If login is the thing that broke in production, that is a different URL allowlist: preview vs production login. If a webhook "succeeds" and the row still does not change, read RLS silent updates.