---
title: "Stripe's webhook endpoint (not for customers)"
method: POST
path: "/v1/stripe/webhook"
tags: ["Billing"]
---

# Stripe's webhook endpoint (not for customers)

`POST /v1/stripe/webhook`

## Request

- Base URL: `https://api.galleyrender.com`
- URL: `https://api.galleyrender.com/v1/stripe/webhook`
- Auth: none required

Stripe calls this; you do not. It is the only unauthenticated write path in the API, and the `Stripe-Signature` header is what stands in for authentication: the raw body is verified against the endpoint's signing secret before a byte of it is parsed.

Handled: `checkout.session.completed`, `customer.subscription.created`, `.updated`, `.deleted`, `invoice.paid`, `invoice.payment_failed`. Idempotent on the Stripe event id, so a redelivery is a no-op. Anything verified answers 200, including an event we do not act on.

## Headers

- `Stripe-Signature` string, required

## Request body

- object: A Stripe Event.

## Response `200`

Verified. `outcome` is `applied`, `ignored`, `unmatched` or `duplicate`.

- object
  - `received` true, required
  - `id` string, required
  - `type` string, required
  - `outcome` 'applied' | 'ignored' | 'unmatched' | 'duplicate', required
  - `account` string
  - `plan` string
  - `reason` string

## Other responses

- `401`: `authentication_error` — missing or invalid signature.

---

[API](https://skmtc.dev/galleyrender/apis/galley-render-api.md) · [All operations](https://skmtc.dev/galleyrender/apis/galley-render-api/llms.txt) · [OpenAPI document](https://skmtc.dev/galleyrender/apis/galley-render-api/revisions/a85d68468cd2?raw)