{
  "id": 17746553,
  "title": "Stripe webhook returns 401 on Supabase Edge Functions (Lovable, Bolt): the --no-verify-jwt fix",
  "url": "https://urgent.news/2026/11/02/stripe-webhook-returns-401-on-supabase-edge-functions-lovable-bolt",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-02T05:04:34.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/agentk_6588bb59c6339/stripe-webhook-returns-401-on-supabase-edge-functions-lovable-bolt-the-no-verify-jwt-fix-55mn"
  },
  "original_language": "en",
  "account": "Supabase Edge Functions require a platform verification called verify_jwt before running your code. This verification expects an Authorization: Bearer Supabase JWT header, which your frontend sends automatically when invoking Supabase functions. However, Stripe's webhook requests sign themselves with your webhook secret and place the signature in the Stripe-Signature header. When Stripe sends a request to your function, the platform checks the JWT header against the Supabase JWT, but Stripe doesn't have a Supabase login token. Consequently, Stripe receives a 401 error, and Stripe retries the request up to three days in live mode. To resolve this issue, you can disable the JWT check specifically for the Stripe webhook function. You can do this by either modifying the supabase/config.toml file or using a deploy-time flag. The recommended approach is to add the [functions.stripe-webhook] section to the config.toml file with verify_jwt = false. After redeploying, ensure that JWT verification is turned off for your webhook function. Keep the Stripe signature check in your function, as it remains the sole security measure. When handling webhook events, read the raw body with await req.text() and never call req.json() first, as re-serialized JSON will no longer match the signature. Use constructEventAsync with the SubtleCrypto provider and set the webhook secret in your code.",
  "summary": "You connected Stripe to your Lovable, Bolt or hand-written Supabase app. Checkout works and the payment shows up in Stripe. But the user never gets Pro. In Stripe → Developers → Webhooks → your endpoint → Event deliveries , every attempt failed with HTTP 401 and a response body that says Missing authorization header (or Invalid JWT ). And your Edge Function logs are empty . Empty logs are the…",
  "key_points": [
    "Stripe webhook returns 401 error due to missing JWT verification",
    "Supabase Edge Functions require verifyjwt before running code",
    "Disable JWT check specifically for Stripe webhook function"
  ],
  "editors_take": "Disabling platform-level JWT verification for specific endpoints allows third-party services to communicate with Supabase functions without triggering authentication errors that disrupt essential webhook event processing.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}