Private betaThis is the SIGSHIP beta. Everything here is live for testers; the public launch is in January.SIGSHIP private betaOpen the app →
  1. Home
  2. The 17 checks
  3. Your Stripe webhook accepts anything
💳 Payments · Fix now (SEV-1)

Your Stripe webhook accepts anything 

In plain English: A webhook is the message Stripe sends your app when someone pays. Your app trusts any message that arrives, without checking it really came from Stripe, so someone can fake a "payment succeeded" message and get your paid plan for free.

What happens if you ship it

Someone posts a fake "payment succeeded" event to your endpoint and gets your paid plan for free.

How to fix it technical

Verify every event with stripe.webhooks.constructEvent, using the raw request body and your webhook signing secret, before you act on it.

Let your AI tool fix it

Paste this into Lovable, Bolt, Cursor, Replit or Claude Code:

Prompt for your AI tool
Fix this problem in my project: Your Stripe webhook accepts anything. Verify every event with stripe.webhooks.constructEvent, using the raw request body and your webhook signing secret, before you act on it. Change only what this fix needs, then tell me what you changed and anything I have to do myself.

Check your app

Run npx sigship in your project folder. It reports this problem as stripe-webhook-unverified, along with 16 other checks. Nothing leaves your computer. New to the terminal?

Questions

How do I verify a Stripe webhook?

Use Stripe's library to check the signature on every event with your webhook signing secret and the raw request body, and reject anything that fails before you act on it.

Where do I find the webhook signing secret?

In the Stripe dashboard, under Developers, then Webhooks, on the page for your endpoint. Keep it in a server-side environment variable.

See every check · Jargon, explained