SIEM and Shared Signals

Stripe billing webhook

POST/webhooks/stripe

Signed by Stripe. Subscription and invoice events for billing.

#Authentication

Issuer signature

No bearer credential: the caller proves itself by signing the raw request body. Anything that does not verify is refused (or, on the card rail, declined) before the body is read.

Stripe's stripe-signature header, checked with the billing webhook secret.

Request

curl -X POST "https://immiscible.fly.dev/webhooks/stripe" \
  -H "stripe-signature: $SIGNATURE"

// signature: computed over the raw body, see the authentication note above
const res = await fetch('https://immiscible.fly.dev/webhooks/stripe', {
  method: 'POST',
  headers: {
    'stripe-signature': signature,
  },
});
const data = await res.json();
console.log(res.status, data);

import requests

# signature: computed over the raw body, see the authentication note above
res = requests.post(
    "https://immiscible.fly.dev/webhooks/stripe",
    headers={
        "stripe-signature": signature,
    },
)
print(res.status_code, res.json())