---
title: "Stripe Webhook"
method: POST
path: "/api/billing/webhook"
tags: ["billing"]
---

# Stripe Webhook

`POST /api/billing/webhook`

## Request

- Base URL: `https://kernelscan.io`
- URL: `https://kernelscan.io/api/billing/webhook`
- Auth: none declared

Receive a Stripe webhook.

Unauthenticated by necessity — Stripe has no credential to present — so the
HMAC signature over the raw body IS the authentication, and it is verified
before the payload is parsed, let alone acted on.

Always answers 200 once the signature checks out, including for events we
do not handle and for a subscription we cannot resolve to a team. A non-2xx
makes Stripe retry for three days and eventually disable the endpoint;
neither an unknown event type nor an orphaned customer is fixed by
redelivery, and both are already in the log.

## Response `200`

Successful Response

- object

---

[API](https://skmtc.dev/kernelscan/apis/kernelscan-api.md) · [All operations](https://skmtc.dev/kernelscan/apis/kernelscan-api/llms.txt) · [OpenAPI document](https://skmtc.dev/kernelscan/apis/kernelscan-api/revisions/4fa51d41484e?raw)