---
title: "verify webhook · RUAL Documentation"
description: "Proves an incoming webhook really came from Stripe, and unpacks the event. Wire the raw request body into payload : a body that has been parsed into an…"
canonical: https://docs.rual.nl/block-types/stripe/stripeconnection_webhook_verify
language: en
---

# verify webhook

This block is part of the [`stripe`](https://docs.rual.nl/block-types/stripe) group and was last modified in core [`v15.0.0`](https://docs.rual.nl/core-versions/150000).

Proves an incoming webhook really came from Stripe, and unpacks the event. **Wire the raw request body** into `payload` : a body that has been parsed into an object and re-encoded will never verify, because the signature covers the exact bytes Stripe sent. Without this block an endpoint acts on anything POSTed to a URL that appears in the Stripe dashboard, the blueprint and every log it passed through.

- flow `flow`

- connection required `stripeconnection`

- raw body required `value` The **raw** request body, exactly as received. Not a parsed object.

- signature header required `value` The `Stripe-Signature` request header.

- webhook secret `value` whsec_… : only needed when the connection's service provider does not hold one.

- tolerance `number` How many seconds old a signature may be. Default 300, matching Stripe's own libraries. 0 disables the age check, which is only right when replaying a captured event.

- flow `flow`

- connection `stripeconnection`

- verified `condition` **Gate everything on this.** False means the payload was not signed with your webhook secret, was too old, or was not signed at all.

- event type `value` e.g. `checkout.session.completed`, `invoice.paid`, `customer.subscription.deleted`.

- event id `value` evt_… : Stripe retries an event until you answer 2xx, so store this and skip one you have already handled.

- object `object` What the event is about : the session, intent or subscription itself.

- object id `value`

- meta data `object` The metadata on that object, so an order GUID set at checkout comes back here.

- live mode `condition` False for test-mode events. A test event reaching a live endpoint is how a staging blueprint ends up fulfilling real orders.

- event `object`

- success `condition`

- error `value` Stripe's own message, or a sentinel like MISSING_SESSION_ID for a problem in the wiring.

- error code `value` Stripe's machine-readable code, e.g. `card_declined`, `resource_missing`.

- decline code `value` Why the bank refused, e.g. `insufficient_funds`. Only set on a declined card.

| `stripe webhook` |
| --- |
| `verify signature` |
| `webhook event` |
| `payment succeeded event` |

### Version history

Introduced in [`v15.0.0`](https://docs.rual.nl/core-versions/150000).

### Service documentation