Webhook signature verification failing intermittently

Almost always encoding. Sign the *raw* request body (bytes), not the parsed JSON. If your framework re-serializes the body before your handler sees it, whitespace/key-order changes will break the signature.