integrating-stripe-webhooks

Provides solutions for Stripe webhook integration, addressing raw body parsing and signature verification issues across frameworks.

Install this skill

or

0/100

Security score

The integrating-stripe-webhooks skill was audited on Mar 4, 2026 and we found 41 security issues across 3 threat categories. Review the findings below before installing.

Categories Tested

Security Issues

medium line 151

Template literal with variable interpolation in command context

SourceSKILL.md

151	const successUrl = `${origin}/orgs?name=${orgName}&subscription=success`;

medium line 154

Template literal with variable interpolation in command context

SourceSKILL.md

154	const successUrl = `${origin}/orgs?name=${encodeURIComponent(orgName)}&subscription=success`;

medium line 2

Webhook reference - potential data exfiltration

SourceSKILL.md

2	name: integrating-stripe-webhooks

medium line 3

Webhook reference - potential data exfiltration

SourceSKILL.md

3	description: Use when implementing Stripe webhook endpoints and getting 'Raw body not available' or signature verification errors - provides raw body parsing solutions and subscription period field fi

medium line 6

Webhook reference - potential data exfiltration

SourceSKILL.md

6	# Integrating Stripe Webhooks

medium line 10

Webhook reference - potential data exfiltration

SourceSKILL.md

10	Stripe webhooks require raw request bodies for signature verification. Most web frameworks parse JSON automatically, breaking verification. This skill provides framework-specific solutions for the raw

medium line 15

Webhook reference - potential data exfiltration

SourceSKILL.md

15	- Getting "Raw body not available" errors from Stripe webhooks

medium line 16

Webhook reference - potential data exfiltration

SourceSKILL.md

16	- Webhook signature verification fails with 400 errors

medium line 17

Webhook reference - potential data exfiltration

SourceSKILL.md

17	- Implementing new Stripe webhook endpoints

medium line 19

Webhook reference - potential data exfiltration

SourceSKILL.md

19	- Webhooks return 404 (route registration issues)

medium line 22

Webhook reference - potential data exfiltration

SourceSKILL.md

22	- General Stripe API integration (not webhooks)

medium line 32

Webhook reference - potential data exfiltration

SourceSKILL.md

32	\| 404 on webhook endpoint \| Register webhook route inside API prefix \|

low line 51

Webhook reference - potential data exfiltration

SourceSKILL.md

51	req.rawBody = body; // Store for webhooks

low line 56

Webhook reference - potential data exfiltration

SourceSKILL.md

56	// In webhook handler

low line 58

Webhook reference - potential data exfiltration

SourceSKILL.md

58	const event = stripe.webhooks.constructEvent(

low line 59

Webhook reference - potential data exfiltration

SourceSKILL.md

59	rawBody, signature, webhookSecret

low line 66

Webhook reference - potential data exfiltration

SourceSKILL.md

66	// Define webhook route BEFORE express.json() middleware

low line 67

Webhook reference - potential data exfiltration

SourceSKILL.md

67	app.post('/webhooks/stripe',

low line 70

Webhook reference - potential data exfiltration

SourceSKILL.md

70	const event = stripe.webhooks.constructEvent(

low line 73

Webhook reference - potential data exfiltration

SourceSKILL.md

73	webhookSecret

low line 78

Webhook reference - potential data exfiltration

SourceSKILL.md

78	app.use(express.json()); // After webhook route

low line 84

Webhook reference - potential data exfiltration

SourceSKILL.md

84	@app.post('/webhooks/stripe')

low line 85

Webhook reference - potential data exfiltration

SourceSKILL.md

85	async def stripe_webhook(request: Request):

low line 89

Webhook reference - potential data exfiltration

SourceSKILL.md

89	event = stripe.Webhook.construct_event(

low line 90

Webhook reference - potential data exfiltration

SourceSKILL.md

90	payload, signature, webhook_secret

medium line 122

Webhook reference - potential data exfiltration

SourceSKILL.md

122	Cause: Webhook routes registered outside API prefix.

low line 125

Webhook reference - potential data exfiltration

SourceSKILL.md

125	// ❌ WRONG - creates /webhooks/stripe instead of /api/v1/webhooks/stripe

low line 131

Webhook reference - potential data exfiltration

SourceSKILL.md

131	await server.register(webhookRoutes, { prefix: '/webhooks' }); // Outside!

low line 138

Webhook reference - potential data exfiltration

SourceSKILL.md

138	await api.register(webhookRoutes, { prefix: '/webhooks' }); // Inside

medium line 161

Webhook reference - potential data exfiltration

SourceSKILL.md

161	- [ ] Register webhook routes inside API prefix (if using one)

medium line 162

Webhook reference - potential data exfiltration

SourceSKILL.md

162	- [ ] Set `STRIPE_WEBHOOK_SECRET` environment variable

medium line 163

Webhook reference - potential data exfiltration

SourceSKILL.md

163	- [ ] Verify webhook secret is configured before processing

medium line 165

Webhook reference - potential data exfiltration

SourceSKILL.md

165	Webhook Handler:

medium line 168

Webhook reference - potential data exfiltration

SourceSKILL.md

168	- [ ] Use `stripe.webhooks.constructEvent()` for verification

low line 192

Webhook reference - potential data exfiltration

SourceSKILL.md

192	# Forward webhooks to local server

low line 193

Webhook reference - potential data exfiltration

SourceSKILL.md

193	stripe listen --forward-to localhost:3000/api/v1/webhooks/stripe

medium line 204

Webhook reference - potential data exfiltration

SourceSKILL.md

204	- Webhooks fail with 400 "Invalid signature"

medium line 210

Webhook reference - potential data exfiltration

SourceSKILL.md

210	- Webhooks verify successfully

medium line 217

Webhook reference - potential data exfiltration

SourceSKILL.md

217	- [Stripe Webhook Signature Verification](https://stripe.com/docs/webhooks/signatures)

low line 217

External URL reference

SourceSKILL.md

217	- [Stripe Webhook Signature Verification](https://stripe.com/docs/webhooks/signatures)

low line 218

External URL reference

SourceSKILL.md

218	- [Stripe Subscription Object](https://stripe.com/docs/api/subscriptions/object)

Scanned on Mar 4, 2026

View Security Dashboard

Install this skill with one command

/learn @pr-pm/integrating-stripe-webhooks

GitHub Stars 95

Rate this skill

Categorydevelopment

UpdatedMarch 29, 2026

openclaw api backend backend-developer growth-marketer product-manager stripe development marketing product