Webhooks

Billing state matters only after the webhook is verified.

Receive subscription events, verify signatures, deduplicate event_id, and return 2xx after safe processing.

Start for free

Outcome

Entitlement does not depend on the customer's browser redirect.

Verify

Check the signature with the one-time signing secret.

Deduplicate

Persist event_id before changing entitlement.

Apply state

Handle created, updated, and canceled by subscription_id.

Integrate from your backend

API keys are server secrets. Never expose them in browser or mobile code.

if (!verifySignature(rawBody, signature, signingSecret)) {
  return new Response("invalid signature", { status: 401 })
}
if (await events.exists(payload.event_id)) return new Response("ok")
await subscriptions.apply(payload)
return new Response("ok")

FAQ

Are webhooks retried?

Yes. Your endpoint must be idempotent and return 2xx for an already processed event.

Should I trust success_url?

Do not treat browser redirects as payment proof; verify a webhook or reconcile through the API.