The Webhook Inbox That Doesn't Delete Your Evidence

// ❌ WRONG: express.json() breaks signature verification
app.use(express.json());
app.post('/api/webhook/stripe', (req, res) => {
  // req.body is already parsed — signature NEVER matches
});

// ✅ CORRECT: Use express.raw() on the webhook route
app.post('/api/webhook/stripe',
  express.raw({ type: 'application/json' }),
  (req, res) => {
    const sig = req.headers['stripe-signature'];
    let event;
    try {
      event = stripe.webhooks.constructEvent(
        req.body, sig, process.env.STRIPE_WEBHOOK_SECRET
      );
    } catch (err) {
      return res.status(400).send(`Webhook Error: ${err.message}`);
    }
    // Process verified event safely
    res.json({ received: true });
  }
);