verify webhook
This block is part of the stripe group and was last modified in core v15.0.0.
verify webhook v15.0.0 Proves an incoming webhook really came from Stripe, and unpacks the event. Wire the raw request body into payload : a body that has been parsed into an object and re-encoded will never verify, because the signature covers the exact bytes Stripe sent. Without this block an endpoint acts on anything POSTed to a URL that appears in the Stripe dashboard, the blueprint and every log it passed through.
- flow
flow - connection required
stripeconnection - raw body required
valueThe raw request body, exactly as received. Not a parsed object.
- signature header required
valueThe
Stripe-Signaturerequest header. - webhook secret
valuewhsec_… : only needed when the connection's service provider does not hold one.
- tolerance
numberHow many seconds old a signature may be. Default 300, matching Stripe's own libraries. 0 disables the age check, which is only right when replaying a captured event.
- flow
flow - connection
stripeconnection - verified
conditionGate everything on this. False means the payload was not signed with your webhook secret, was too old, or was not signed at all.
- event type
valuee.g.
checkout.session.completed,invoice.paid,customer.subscription.deleted. - event id
valueevt_… : Stripe retries an event until you answer 2xx, so store this and skip one you have already handled.
- object
objectWhat the event is about : the session, intent or subscription itself.
- object id
value - meta data
objectThe metadata on that object, so an order GUID set at checkout comes back here.
- live mode
conditionFalse for test-mode events. A test event reaching a live endpoint is how a staging blueprint ends up fulfilling real orders.
- event
object - success
condition - error
valueStripe's own message, or a sentinel like MISSING_SESSION_ID for a problem in the wiring.
- error code
valueStripe's machine-readable code, e.g.
card_declined,resource_missing. - decline code
valueWhy the bank refused, e.g.
insufficient_funds. Only set on a declined card.
stripe webhook |
verify signature |
webhook event |
payment succeeded event |
Version history
Introduced in v15.0.0.
Service documentation
External API reference This block wraps a third-party service. Click here for the service's own documentation of the underlying endpoint.Back to
stripe Return to the main group to view all sub-groups Back to webhooks Return to the group to view all blocks within this group