The webhook anyone could send
Twelve accounts upgraded to Pro overnight. shows no payments from any of them.
This answers: Why must I verify Stripe webhook signatures? No coding needed. 3 quick decisions.
- Payments and webhooks
- Keys and secrets
Checking your access…
Why must I verify Stripe webhook signatures?
Because your URL is public and anyone can send it a fake 'checkout completed' event with their own user id. signs every event with your webhook signing secret. Verify the Stripe-Signature header with stripe.webhooks.constructEvent using the raw request body, reject anything that fails, and only then grant access or credits.
Breaks at Your server: Webhook never checks Stripe's signature
Why AI tools write this bug
AI tools often parse the body as JSON and act on it, skipping signature checks because they need the raw body and a secret to be configured.
How to fix it
- Add STRIPE_WEBHOOK_SECRET to server settings.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Isn't a long secret URL enough?
- No. URLs leak through logs, code and screenshots, and common paths like /api/stripe/webhook are easy to guess. Signatures prove the sender.