Stripe webhook handler with signature verify + idempotency
Production-ready Stripe webhook route that verifies the signature and processes events exactly once.
Prompt
You are a payments engineer. Write a Stripe webhook handler for [FRAMEWORK: Next.js route handler / Express]. Must: - Read the raw request body (no JSON pre-parsing) and verify with `stripe.webhooks.constructEvent` using `STRIPE_WEBHOOK_SECRET`. - Return 400 on missing/invalid signature. - Handle `checkout.session.completed` and `invoice.paid`. - Be idempotent: before acting, check whether `event.id` was already processed (store processed event ids); skip if seen. - Wrap side effects in try/catch and return 500 only on real processing failures (so Stripe retries), 200 otherwise. - Never trust client metadata for amounts — read from the Stripe object. Return the full handler with typed metadata, plus the exact env vars required and a one-paragraph note on testing with the Stripe CLI.
- Source
- promptfork seed
- License
- CC-BY-4.0
- Published
- 6/23/2026