Webhook Blog
Practical writeups on Stripe webhook implementation, distilled from a working production pipeline. New posts as new traps surface.
Stripe Webhook Didn't Fire — Debugging Checklist (2026)
Customer paid, no webhook. The 7 silent failure modes ranked by frequency: wrong mode, missing event types, blocked CDN, retries gave up, endpoint disabled, Connect platform gap. Plus the dashboard field that solves it in 30s.
read →How to Rotate Your Stripe Webhook Secret Without Downtime
Naive secret rotation drops 30s-5min of events. The dual-secret cutover pattern moves zero events to /dev/null. Working code, dashboard steps, edge cases (multi-tenant, queued handlers, leaked-to-git recovery), verification checklist.
read →Resend vs Postmark vs SendGrid for Stripe Webhook Emails (2026)
Pricing, deliverability, DX comparison. Decision tree by scale: Resend under 50k/mo, Postmark for regulated/financial, SendGrid for 100k+ volume. Gotchas: domain verification, bounce handling, free-tier rate limits.
read →Testing Stripe Webhooks Locally: Stripe CLI vs ngrok vs Cloudflare Tunnel
Three approaches to bridging localhost to Stripe. Stripe CLI for daily dev, ngrok for shareable URLs, Cloudflare Tunnel for permanent custom-domain. The gotcha each one hides.
read →Stripe Webhook Idempotency: How to Handle Duplicate Events Without Double-Charging
Stripe delivers the same event multiple times. Without idempotency, you double-charge customers, send duplicate emails, corrupt your database. Atomic claim-check pattern with code for KV, Postgres, and high-stakes two-phase commits.
read →Stripe Webhook Retry Behavior: How Long, How Often, and What Triggers It
Exact retry schedule (5min → 30min → 2hr → 4hr → 8hr → 16hr → daily, up to 72h total). What counts as failure. When Stripe disables your endpoint. How to recover dropped events via dashboard or events.list API replay.
read →Why Stripe Fires 6+ Webhook Events Per Checkout (and How to Handle Each)
A single checkout generates between 4 and 8 events delivered within 1 second. Naive handlers fire customer emails 6 times for one purchase. Includes idempotency-key pattern, event ordering, and refund handling.
read →Why Your Stripe Webhook Returns 400 in Production (and How to Fix It)
Works on localhost, breaks on Vercel. The four root causes ranked by frequency. Body-parser eating raw bytes, ===-vs-timingSafeEqual leak, replay-attack timestamp window, and downstream-fail retry storm. Working code per cause.
read →