How can I resolve the invalid HMAC signature for Authorize.Net webhooks in Node.js?

Below is a list of common issues and suggestions you can check to resolve the invalid HMAC signature:

---

1. Use the Unmodified (Raw) Request Body

When Authorize.Net generates the signature they hash the exact JSON string sent in the request. By parsing the JSON into an object and then re‑stringifying it, you may inadvertently change the whitespace or key order. Instead, compute the HMAC using the raw request body data. If you’re using Express, you can capture the raw body by using a custom body parser or middleware. For example:

JAVASCRIPTCopied
// Capture the raw body in Express
app.use(express.json({
  verify: (req, res, buf) => {
    req.rawBody = buf;
  }
}));

app.post('/webhook', (req, res) => {
  const rawPayload = req.rawBody;
  const receivedHMAC = req.headers['x-anet-signature'];
  
  if (verifyHMAC(rawPayload, receivedHMAC)) {
    // Process your webhook and change invoice status
    res.sendStatus(200);
  } else {
    res.sendStatus(400);
  }
});

And update your verification function to use the raw payload (which is a Buffer):

JAVASCRIPTCopied
const verifyHMAC = (rawPayload, receivedHMAC) => {
  if (!receivedHMAC) {
    console.error("Received HMAC is missing.");
    return false;
  }

  // Remove the prefix ("sha512=")
  const signatureWithoutPrefix = receivedHMAC.split("=")[1]?.trim();
  if (!signatureWithoutPrefix) {
    console.error("Invalid HMAC format received.");
    return false;
  }

  // Use the raw payload directly without stringifying an object
  const hmac = crypto.createHmac(
    "sha512",
    Buffer.from(process.env.AUTHORIZE_NET_SIGNATURE_KEY, "hex")
  );
  hmac.update(rawPayload);
  const computedHMAC = hmac.digest("hex");

  console.log("Received HMAC:", signatureWithoutPrefix);
  console.log("Computed HMAC:", computedHMAC);

  if (computedHMAC.length !== signatureWithoutPrefix.length) {
    console.error("Computed and received HMAC lengths do not match.");
    return false;
  }

  return crypto.timingSafeEqual(
    Buffer.from(computedHMAC, "hex"),
    Buffer.from(signatureWithoutPrefix, "hex")
  );
};

---

2. Verify the Key Format

Ensure that the value of process.env.AUTHORIZE_NET_SIGNATURE_KEY is in the correct hex format. Check the following:

• The key you obtain from Authorize.Net should be a hex string.
• There should be no extra whitespace or characters.
• If your key is not hex (for example, if it’s provided in base64 or plain text), you need to adjust how you convert it for the HMAC creation.

For example, if it’s not in hex, you might instantiate the key like so:

JAVASCRIPTCopied
Buffer.from(process.env.AUTHORIZE_NET_SIGNATURE_KEY, "utf8")

Only use "hex" if you are sure the key is a hex string.

---

3. Compare the Exact Payload

Double-check that the payload you use for creating the HMAC is exactly the same string that Authorize.Net signed. Any differences (even in a minor whitespace) will break the HMAC. This is why using the raw body captured in middleware is the preferred method.

---

4. Testing Your Endpoint

When testing with Postman or any other tool, ensure that:

• You are sending the payload exactly as expected.
• You are not modifying the payload accidentally by additional formatting or by the test tool.

---

By ensuring you hash the exact raw string and that your signature key is formatted correctly, your computed HMAC should match the one provided in the request header. This should resolve the “Invalid HMAC signature” error.