remotion-dev/remotion · error · TypeError

No 'body' was provided to validateWebhookSignature().

Error message

No 'body' was provided to validateWebhookSignature().

What it means

Thrown by validateWebhookSignature() when the `body` argument is falsy. The HMAC is computed over the JSON-serialized request body, so an empty/missing body cannot be authenticated — the signature would always be wrong.

Source

Thrown at packages/lambda-client/src/validate-webhook-signature.ts:21

 * @see [Documentation](https://remotion.dev/docs/lambda/validatewebhooksignature)
 */
export const validateWebhookSignature = ({
	secret,
	body,
	signatureHeader,
}: {
	secret: string;
	body: unknown;
	signatureHeader: string;
}) => {
	if (!secret) {
		throw new TypeError(
			"No 'secret' was provided to validateWebhookSignature().",
		);
	}

	if (!body) {
		throw new TypeError(
			"No 'body' was provided to validateWebhookSignature().",
		);
	}

	if (typeof require === 'undefined') {
		throw new Error('validateWebhookSignature can only be called from Node.JS');
	}

	const Crypto = require('crypto');

	const hmac = Crypto.createHmac('sha512', secret);
	const signature = `sha512=${hmac.update(JSON.stringify(body)).digest('hex')}`;

	if (!signatureHeader || signatureHeader === 'NO_SECRET_PROVIDED') {
		throw new Error('No webhook signature was provided');
	}

	if (signatureHeader !== signature) {

View on GitHub (pinned to 78fe4bb3fd)

Solutions

1. Register body-parser / express.json() before the webhook route so req.body is populated.
2. Reject requests with no body at the route level (404/400) before invoking the validator.
3. Confirm the request is a POST with Content-Type: application/json.

Example fix

// before
app.post('/webhook', (req, res) => {
  validateWebhookSignature({secret, body: req.body, signatureHeader: req.headers['X-Remotion-Signature']});
});

// after
app.post('/webhook', express.json(), (req, res) => {
  if (!req.body) return res.status(400).send('empty body');
  validateWebhookSignature({secret, body: req.body, signatureHeader: req.headers['X-Remotion-Signature']});
});

if (!req.body) return res.status(400).send('empty body');
validateWebhookSignature({secret, body: req.body, signatureHeader});

const hasBody = (b: unknown): boolean => b !== undefined && b !== null && b !== '';

try {
  validateWebhookSignature({secret, body: req.body, signatureHeader});
} catch (err) {
  return res.status(401).send('unauthorized');
}

When it happens

Trigger: Calling validateWebhookSignature with body: null, body: undefined, body: '' or body: 0. The guard is `if (!body)`.

Common situations: Reading req.body before the body parser has populated it; an incoming GET probe with no body; a framework that sets body to null for empty payloads; misordered middleware.

Related errors

• No 'secret' was provided to validateWebhookSignature().
• No webhook signature was provided
• Signatures do not match
• Invalid public file path: ${path}
• The public directory was specified as "${p}", which is the r

AI-assisted analysis of remotion-dev/remotion@78fe4bb3fd (2026-08-12). Data as JSON: /api/errors/a0571b274d7b87b7. Report an issue: GitHub.