Webhooks

Billing state matters only after the webhook is verified.

Receive subscription events, verify signatures, deduplicate event_id, and update access safely. Ensure entitlements never depend on client browser redirects.

Start for free

Outcome

Entitlement does not depend on the customer's browser redirect.

Verify

Check the signature with the one-time signing secret.

Deduplicate

Persist event_id before changing entitlement.

Apply state

Handle created, updated, and canceled by subscription_id.

Integrate from your backend

API keys are server secrets. Never expose them in browser or mobile code.

if (!verifySignature(rawBody, signature, signingSecret)) {
  return new Response("invalid signature", { status: 401 })
}
if (await events.exists(payload.event_id)) return new Response("ok")
await subscriptions.apply(payload)
return new Response("ok")

FAQ

Are webhooks retried?

Yes. Your endpoint must be idempotent and return 2xx for an already processed event.

Should I trust success_url?

Do not treat browser redirects as payment proof; verify a webhook or reconcile through the API.