2026-10-15 · The Rivyva team · eight minute read
Stripe webhooks: the three checks every AI-built app needs before taking money
When someone pays you through Stripe, Stripe tells your app with a webhook: a message sent to a URL on your server. If your app believes any message that arrives at that URL, anyone can tell it that a person paid without paying. AI builders often generate a webhook handler that works in testing but skips the checks that matter.
First, verify the signature. Stripe signs the raw body. If you parse JSON before verifying, the bytes change and the check fails, so people are tempted to skip it. Read the raw body, then use the webhook secret to construct the event. Reject anything that does not verify.
Second, handle each event once. Stripe retries. Store the event id and skip an id you have already processed, or a customer can be granted access twice.
Third, set the price on the server. If the payment page uses an amount from the browser, the buyer can change it. Look the price up from your own list.
A related mistake is granting access on the success page. That page opens for anyone who has the URL. Grant access from the verified payment event.
Stripe's CLI can forward test events to your machine. Send a valid event, a bad signature and a duplicate, and check the three outcomes.
The checks for this are PAY-001, PAY-002, PAY-003 and PAY-004. A webhook drill, when you are on a paid rescue, runs those cases against staging, never against your live app.
Source: https://docs.stripe.com/webhooks