Question 1

How does Stripe webhook signature verification work?

Accepted Answer

Stripe signs every webhook payload with a secret key unique to your endpoint. The signature header follows the format `t=timestamp,v1=signature` where `signature` is an HMAC SHA256 hash of the timestamp and payload body, using your webhook signing secret as the key. This tool lets you paste any payload and signature, provide your secret, and verify them without needing the Stripe CLI.

Question 2

Is my webhook secret stored or sent anywhere?

Accepted Answer

No. All signature verification happens entirely in your browser. Your webhook secret is never stored, transmitted, or logged anywhere. It is used only to compute the HMAC locally for comparison.

Question 3

What does it mean if my signature verification fails?

Accepted Answer

A failed verification usually means one of three things: (1) The payload was modified after Stripe sent it, even a whitespace change will break the signature. (2) The wrong webhook secret is being used, each endpoint has its own secret in the Stripe dashboard. (3) The signature header was altered or malformed. If verification fails unexpectedly, re-download the raw payload from your Stripe dashboard and try again.

Question 4

How do I find my webhook signing secret?

Accepted Answer

In the Stripe dashboard, go to Developers → Webhooks → select your endpoint → under "Signing secret", click "reveal". Each endpoint has a unique secret starting with `whsec_`. You can also use the Stripe CLI: `stripe listen --forward-to localhost:3000/api/webhooks/stripe` which prints the secret automatically.

Question 5

What Stripe event types should I handle in my integration?

Accepted Answer

Common essential events include: `payment_intent.succeeded` (confirm payment), `payment_intent.payment_failed` (handle failure), `customer.subscription.created` (activate access), `customer.subscription.deleted` (revoke access), `invoice.payment_succeeded` (renew billing), `invoice.payment_failed` (dunning). For e-commerce, also handle `charge.refunded`. The specific events depend on your business logic.

Question 6

Can I test webhooks locally without the Stripe CLI?

Accepted Answer

Yes. This tool lets you paste webhook payloads and verify signatures without any CLI. For full local testing with live webhook delivery, you would normally need the Stripe CLI (`stripe listen`) or a tunneling tool like ngrok. This tool is ideal for debugging captured payloads from your Stripe dashboard or logs, and verifying your signing setup.

Event	Delivered	Status	Attempts
succeeded	2 min ago	Delivered	1
refunded	18 min ago	Delivered	1
customer.subscription.created	1 hr ago	Failed	3
payment_succeeded	3 hrs ago	Delivered	1
payment_failed	5 hrs ago	Delivered	2

Event	Delivered	Status	Attempts
succeeded	2 min ago	Delivered	1
refunded	18 min ago	Delivered	1
customer.subscription.created	1 hr ago	Failed	3
payment_succeeded	3 hrs ago	Delivered	1
payment_failed	5 hrs ago	Delivered	2

Stripe Webhook Tester

Building with Stripe webhooks?

Frequently Asked Questions

Stripe Webhook Tester

Building with Stripe webhooks?

Frequently Asked Questions