Fix Stripe Webhook Error: 400 Bad Request (Stripe Token Mismatch)

by

When processing international credit card payments via WooCommerce Stripe, your webhooks act as the crucial, real-time communication line between Stripe’s servers and your WordPress database. If a customer fills out their card data, completes their 3D Secure or bank authentication, and your site suddenly drops the connection with a 400 Bad Request error, the payment will settle in Stripe, but the order inside WooCommerce will remain stuck as “Pending Payment” or fail entirely.

Standard support advice usually tells you to “disconnect and reconnect Stripe.” This is ineffective because a Token Mismatch error means the encrypted payloads passing between the platforms fail verification checks.

Below is the deep-tech breakdown of why this payment hand-off breaks and the exact configurations required to clear the token mismatch loop immediately.

The Error Snippet

When you log into your Stripe Dashboard -> Developers -> Webhooks, select your endpoint URL, and check the failing HTTP request logs, you will find this exact payload structure:

Plaintext

Response status: 400 Bad Request
Response body:
{
  "error": "Stripe Token Mismatch. The signature validation failed or the webhook signing secret is invalid for endpoint context.",
  "status": "fail"
}

Why This Happens (The Real Technical Cause)

To prevent malicious script injections from forging fake payment confirmations, WooCommerce uses an end-to-end cryptographic handshake. When Stripe sends a data payload (like charge.succeeded or payment_intent.succeeded) to your site’s webhook endpoint (https://techbic.site/wp-json/wc/v3/stripe_webhooks), it signs the payload using a unique Webhook Signing Secret.

A 400 Bad Request (Stripe Token Mismatch) occurs due to two specific backend conflicts:

  1. The Endpoint Secret Discrepancy: You copied the main account API Secret Key (sk_live…) into the Webhook Secret configuration field inside WooCommerce instead of using the dedicated webhook-specific secret string (whsec_…).
  2. Reverse Proxy / Cloudflare Cache Strangling: If your domain passes through Cloudflare or an edge-caching firewall, the server strips out or modifies the HTTP_STRIPE_SIGNATURE header during data transmission. When WooCommerce processes the request, the signature token fails validation because the string format was altered by the proxy.

How to Fix It Safely (Step-by-Step Solutions)

Follow these technical configuration steps to regenerate your cryptographic tokens and ensure your server doesn’t alter webhook headers.

1.Extract the True Webhook Secret from Stripe:Step 1.

Log into your Stripe Dashboard and go to Developers -> Webhooks. Click on your specific website endpoint URL. Look at the top right section for Signing secret, click Reveal, and copy the exact string that starts with whsec_.... Do not copy your main API key.

2.Update the WooCommerce Crypto Container:Step 2.

Go to your WordPress Admin Dashboard -> WooCommerce -> Settings -> Payments -> Stripe -> Manage. Scroll down to the Webhook section. Paste the whsec_... key directly into the Webhook Signing Secret field. Save your changes to flush old cached tokens out of the database options table.

3.Exclude Webhooks from Cache Rules:Step 3.

If you use a caching plugin like LiteSpeed Cache, WP Rocket, or server-side Nginx caching, you must completely isolate the webhook endpoint route. Add this directory path to your plugin’s Never Cache URLs / Exclusion List:

/wp-json/wc/v3/stripe_webhooks

4.Restore Modified Proxy Headers in wp-config.php:Step 4.

If your site runs behind Cloudflare or a reverse proxy, the signature header may lose its verification properties. Open your site’s wp-config.php file using a file manager and append this technical handling instruction near the top of the script:

PHP

if ( isset( $_SERVER['HTTP_CF_CONNECTING_IP'] ) ) {
    $_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_CF_CONNECTING_IP'];
}

Pro-Tip for testing the fix: You do not need to wait for a real customer to make a purchase to test your work. Inside your Stripe Dashboard webhook view, click the Resend button next to any failed 400 Bad Request log. This forces Stripe to re-dispatch the exact same transaction payload. If your configuration was done correctly, the status indicator will instantly flip from a red 400 to a green 200 OK.

Leave a Comment