tl-openmeter-local-dev

Facilitates local development and troubleshooting of OpenMeter with Docker, Stripe, and webhook configurations.

Install this skill

or

0/100

Security score

The tl-openmeter-local-dev skill was audited on May 12, 2026 and we found 61 security issues across 3 threat categories, including 16 high-severity. Review the findings below before installing.

Categories Tested

Security Issues

medium line 95

Curl to non-GitHub URL

SourceSKILL.md

95	curl http://localhost:8888/api/v1/meters

high line 120

Curl to non-GitHub URL

SourceSKILL.md

120	Verify: `curl http://localhost:8888/api/v1/apps` â€” should show Stripe (Sandbox may also be present and is irrelevant).

high line 131

Curl to non-GitHub URL

SourceSKILL.md

131	4. Get URL: `curl http://127.0.0.1:4040/api/tunnels`

medium line 201

Curl to non-GitHub URL

SourceSKILL.md

201	curl http://localhost:8888/api/v1/meters

medium line 204

Curl to non-GitHub URL

SourceSKILL.md

204	curl http://localhost:8888/api/v1/apps

medium line 207

Curl to non-GitHub URL

SourceSKILL.md

207	curl -X POST http://127.0.0.1:3001/webhooks/openmeter \

medium line 3

Webhook reference - potential data exfiltration

SourceSKILL.md

3	description: Set up and troubleshoot OpenMeter for local development with Docker, ngrok, Stripe app, and webhook configuration. Covers self-hosted vs Cloud differences, catalog sync, environment-aware

medium line 18

Webhook reference - potential data exfiltration

SourceSKILL.md

18	Run OpenMeter locally with full metering, billing, and webhook support. Covers the gotchas that differ between self-hosted (Docker) and Cloud (staging/production).

medium line 23

Webhook reference - potential data exfiltration

SourceSKILL.md

23	- "Configure ngrok for webhooks"

medium line 25

Webhook reference - potential data exfiltration

SourceSKILL.md

25	- "Why is my webhook 500ing?"

medium line 28

Webhook reference - potential data exfiltration

SourceSKILL.md

28	- When user mentions OpenMeter + Docker, local dev, or webhook issues

medium line 44

Webhook reference - potential data exfiltration

SourceSKILL.md

44	- [references/webhooks.md](references/webhooks.md) â€” Webhook auth modes, event types, testing

medium line 78

Webhook reference - potential data exfiltration

SourceSKILL.md

78	\| Webhook channels via API \| NO ("not implemented") \| Yes (Svix-backed) \|

medium line 79

Webhook reference - potential data exfiltration

SourceSKILL.md

79	\| Webhook notifications \| Yes (YAML config only) \| Yes (API channels) \|

medium line 82

Webhook reference - potential data exfiltration

SourceSKILL.md

82	Key insight: Webhooks work locally via `config.local.yaml` static configuration. Cloud uses the `POST /api/v1/notification/channels` API (Svix). The catalog sync script handles this automatically.

medium line 126

Webhook reference - potential data exfiltration

SourceSKILL.md

126	Required for Stripe App callbacks and Stripe webhooks locally.

low line 136

Webhook reference - potential data exfiltration

SourceSKILL.md

136	npx tsx scripts/openmeter/set-openmeter-webhook-url.ts

medium line 151

Webhook reference - potential data exfiltration

SourceSKILL.md

151	Expected local output includes `âŠ˜ Skipping webhook channel (not supported on self-hosted OpenMeter)` â€” this is normal.

medium line 167

Webhook reference - potential data exfiltration

SourceSKILL.md

167	## Step 6: Configure Stripe Webhooks

medium line 169

Webhook reference - potential data exfiltration

SourceSKILL.md

169	In [Stripe Dashboard](https://dashboard.stripe.com/test/webhooks):

medium line 171

Webhook reference - potential data exfiltration

SourceSKILL.md

171	1. Add endpoint: `https://YOUR-NGROK-URL/webhooks/stripe`

medium line 173

Webhook reference - potential data exfiltration

SourceSKILL.md

173	3. Copy signing secret to `.env` as `STRIPE_WEBHOOK_SECRET_DEV=whsec_...`

medium line 177

Webhook reference - potential data exfiltration

SourceSKILL.md

177	## Webhook Authentication

medium line 179

Webhook reference - potential data exfiltration

SourceSKILL.md

179	See [references/webhooks.md](references/webhooks.md) for full details.

medium line 183

Webhook reference - potential data exfiltration

SourceSKILL.md

183	\| Svix signatures \| Cloud (staging/prod) \| `SVIX_WEBHOOK_SECRET` + Svix headers \|

medium line 184

Webhook reference - potential data exfiltration

SourceSKILL.md

184	\| x-webhook-secret \| Self-hosted with secret \| `OPENMETER_WEBHOOK_SECRET` header check \|

low line 206

Webhook reference - potential data exfiltration

SourceSKILL.md

206	# Webhook endpoint responding

low line 207

Webhook reference - potential data exfiltration

SourceSKILL.md

207	curl -X POST http://127.0.0.1:3001/webhooks/openmeter \

medium line 238

Webhook reference - potential data exfiltration

SourceSKILL.md

238	- [ngrok](https://ngrok.com/docs) â€” Secure tunnels for webhook testing

high line 3

Ngrok tunnel reference

SourceSKILL.md

3	description: Set up and troubleshoot OpenMeter for local development with Docker, ngrok, Stripe app, and webhook configuration. Covers self-hosted vs Cloud differences, catalog sync, environment-aware

high line 5

Ngrok tunnel reference

SourceSKILL.md

5	compatibility: Requires Docker Desktop, Node.js 18+, PowerShell or Bash. Ngrok required for Stripe billing.

high line 23

Ngrok tunnel reference

SourceSKILL.md

23	- "Configure ngrok for webhooks"

high line 59

Ngrok tunnel reference

SourceSKILL.md

59	- Yes â†’ Steps 1, 2, 3, 4, 5, 6 (full setup with ngrok)

high line 62

Ngrok tunnel reference

SourceSKILL.md

62	Question 3: Ngrok status (only if Stripe = yes)

high line 63

Ngrok tunnel reference

SourceSKILL.md

63	- Already set up â†’ skip ngrok install in Step 3

high line 124

Ngrok tunnel reference

SourceSKILL.md

124	## Step 3: Set Up Ngrok

high line 128

Ngrok tunnel reference

SourceSKILL.md

128	1. Install: `choco install ngrok` (Windows) or `brew install ngrok` (macOS)

high line 129

Ngrok tunnel reference

SourceSKILL.md

129	2. Auth: `ngrok config add-authtoken YOUR_TOKEN`

high line 130

Ngrok tunnel reference

SourceSKILL.md

130	3. Start: `.\scripts\start-ngrok.ps1` or `ngrok http 3001`

high line 163

Ngrok tunnel reference

SourceSKILL.md

163	For ngrok HTTP forwarding, set `API_HTTP_FOR_NGROK=true` in `.env`.

high line 171

Ngrok tunnel reference

SourceSKILL.md

171	1. Add endpoint: `https://YOUR-NGROK-URL/webhooks/stripe`

high line 222

Ngrok tunnel reference

SourceSKILL.md

222	\| Ngrok URL changed \| Update `.env`, `config.local.yaml`, Stripe Dashboard; restart OpenMeter \|

high line 238

Ngrok tunnel reference

SourceSKILL.md

238	- [ngrok](https://ngrok.com/docs) â€” Secure tunnels for webhook testing

medium line 118

Access to .env file

SourceSKILL.md

118	Requires: `STRIPE_SECRET_KEY` in `.env`

medium line 163

Access to .env file

SourceSKILL.md

163	For ngrok HTTP forwarding, set `API_HTTP_FOR_NGROK=true` in `.env`.

medium line 173

Access to .env file

SourceSKILL.md

173	3. Copy signing secret to `.env` as `STRIPE_WEBHOOK_SECRET_DEV=whsec_...`

medium line 222

Access to .env file

SourceSKILL.md

222	\| Ngrok URL changed \| Update `.env`, `config.local.yaml`, Stripe Dashboard; restart OpenMeter \|

low line 95

External URL reference

SourceSKILL.md

95	curl http://localhost:8888/api/v1/meters

low line 98

External URL reference

SourceSKILL.md

98	Portal UI: `http://localhost:8889`

low line 120

External URL reference

SourceSKILL.md

120	Verify: `curl http://localhost:8888/api/v1/apps` â€” should show Stripe (Sandbox may also be present and is irrelevant).

low line 131

External URL reference

SourceSKILL.md

131	4. Get URL: `curl http://127.0.0.1:4040/api/tunnels`

low line 169

External URL reference

SourceSKILL.md

169	In [Stripe Dashboard](https://dashboard.stripe.com/test/webhooks):

low line 171

External URL reference

SourceSKILL.md

171	1. Add endpoint: `https://YOUR-NGROK-URL/webhooks/stripe`

low line 201

External URL reference

SourceSKILL.md

201	curl http://localhost:8888/api/v1/meters

low line 204

External URL reference

SourceSKILL.md

204	curl http://localhost:8888/api/v1/apps

low line 207

External URL reference

SourceSKILL.md

207	curl -X POST http://127.0.0.1:3001/webhooks/openmeter \

low line 232

External URL reference

SourceSKILL.md

232	- [OpenMeter Docker Setup](https://openmeter.io/docs/installation/docker) â€” Official Docker guide

low line 233

External URL reference

SourceSKILL.md

233	- [OpenMeter Self-Hosted](https://openmeter.io/docs/guides/self-hosted) â€” Self-hosting guide

low line 234

External URL reference

SourceSKILL.md

234	- [Stripe App Setup](https://openmeter.io/docs/guides/stripe) â€” Stripe integration

low line 238

External URL reference

SourceSKILL.md

238	- [ngrok](https://ngrok.com/docs) â€” Secure tunnels for webhook testing

low line 239

External URL reference

SourceSKILL.md

239	- [Stripe CLI](https://stripe.com/docs/stripe-cli) â€” Local Stripe development

Scanned on May 12, 2026

View Security Dashboard

Installation guide →

Rate this skill

Categorymarketing

UpdatedMay 13, 2026

cursor frontend stripe docx git api testing devops backend growth-marketer product-marketer backend-developer devops-sre data-analyst docker stripe marketing development data analytics

toddlevy/tl-agent-skills