WebhookProofGuides · Free check · $9 fix pack

Guides

Supabase Edge Function 401 on your Stripe webhook

Your Stripe event deliveries show 401, and the response body is {"code":401,"message":"Missing authorization header"} or an "Invalid JWT" message. Your function code never ran.

Why it happens

Supabase: "By default, Edge Functions require a valid JWT in the authorization header" (Supabase docs). Supabase's 401 guide says both the "Missing authorization header" and invalid-token messages "come from the legacy auth verification check", which "runs before your code. When it fails, your function never executes" (Supabase docs). Stripe doesn't have your user tokens, so it can't pass that check. Stripe lists 401 and 403 as access restrictions on the destination URL (Stripe docs).

Fix 1: turn off the JWT check for the webhook function only

In supabase/config.toml, as in Supabase's own config docs (source):

[functions.stripe-webhook]
verify_jwt = false

Or deploy with the CLI flag (Supabase CLI):

supabase functions deploy stripe-webhook --no-verify-jwt

Supabase's 401 guide also lists turning JWT verification off in the function's details in the Dashboard (source).

Fix 2 (not optional): verify the Stripe signature

Supabase warns that turning the check off "will allow anyone to invoke your Edge Function without a valid JWT" (source). Supabase's Stripe example handles this by verifying the signature with the raw body; its source says "Stripe verifies the request via its signature, so deploy with verify_jwt = false" (Supabase example source):

import Stripe from 'npm:stripe'

const stripe = new Stripe(Deno.env.get('STRIPE_API_KEY') as string)
const cryptoProvider = Stripe.createSubtleCryptoProvider()

Deno.serve(async (req) => {
  const signature = req.headers.get('Stripe-Signature')
  const body = await req.text() // raw body, not req.json()
  let event
  try {
    event = await stripe.webhooks.constructEventAsync(
      body, signature!, Deno.env.get('STRIPE_WEBHOOK_SIGNING_SECRET')!, undefined, cryptoProvider
    )
  } catch (err) {
    return new Response(err.message, { status: 400 })
  }
  // handle event.type, then return 200 quickly
  return Response.json({ ok: true })
})

Adapted from Supabase's example, which wraps the same logic in its own server helper; check the linked source for the current version.

Still 401 after that?

If the body is a message you wrote (or empty), your own code returned the 401. Supabase says to search your function for 401 and trace the condition (source). Building with Lovable or Bolt? See the Supabase guide for AI-built apps.

FAQ

Sources

• Supabase docs: Edge Function 401 error response
• Supabase docs: Function configuration
• Supabase CLI reference: functions deploy
• Supabase example: stripe-webhooks Edge Function source
• Stripe docs: Receive Stripe events in your webhook endpoint

More guides

Stripe webhook not working? Check these 7 things in order · A customer paid but didn't get access. What went wrong? · No signatures found matching the expected signature for payload · Stripe webhook failing with a 307 or 308 redirect

Last reviewed 2026-10-18. WebhookProof is an independent tool, not affiliated with Stripe, Inc.. Quotes are from the linked documentation.