Stripe webhook returns 401 on Supabase Edge Functions (Lovable, Bolt): the --no-verify-jwt fix
You connected Stripe to your Lovable, Bolt or hand-written Supabase app. Checkout works and the payment shows up in Stripe. But the user never gets Pro. In Stripe → Developers → Webhooks → your endpoint → Event deliveries , every attempt failed with HTTP 401 and a response body that says Missing authorization header (or Invalid JWT ). And your Edge Function logs are empty . Empty logs are the…
Supabase Edge Functions require a platform verification called verify_jwt before running your code. This verification expects an Authorization: Bearer Supabase JWT header, which your frontend sends automatically when invoking Supabase functions. However, Stripe's webhook requests sign themselves with your webhook secret and place the signature in the Stripe-Signature header.
When Stripe sends a request to your function, the platform checks the JWT header against the Supabase JWT, but Stripe doesn't have a Supabase login token. Consequently, Stripe receives a 401 error, and Stripe retries the request up to three days in live mode. To resolve this issue, you can disable the JWT check specifically for the Stripe webhook function.
You can do this by either modifying the supabase/config.toml file or using a deploy-time flag. The recommended approach is to add the [functions.stripe-webhook] section to the config.toml file with verify_jwt = false. After redeploying, ensure that JWT verification is turned off for your webhook function. Keep the Stripe signature check in your function, as it remains the sole security measure.
When handling webhook events, read the raw body with await req.text() and never call req.json() first, as re-serialized JSON will no longer match the signature. Use constructEventAsync with the SubtleCrypto provider and set the webhook secret in your code.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
