---
title: "Stripe webhook for Watching subscriptions — verify payment and fulfill the exact record"
method: POST
path: "/v1/stripe/webhook"
---

# Stripe webhook for Watching subscriptions — verify payment and fulfill the exact record

`POST /v1/stripe/webhook`

## Request

- Base URL: `https://api.lodestarstamp.com`
- URL: `https://api.lodestarstamp.com/v1/stripe/webhook`
- Auth: one of:
  - none
  - API key in header `X-Lodestar-Key`
  - OAuth 2 (authorization code, authorization URL `https://api.lodestarstamp.com/oauth/authorize`, token URL `https://api.lodestarstamp.com/oauth/token`, scopes: `mcp:read`)
  - API key in header `PAYMENT-SIGNATURE`

Verifies Stripe-Signature with STRIPE_WEBHOOK_SECRET and re-reads current Stripe subscription state. Only an exact supported price, confirmed payment, and explicit unambiguous business identity grant entitlement. Per-subscription Durable Object storage coordinates event and baseline dedupe; CONSUMERS is a discovery index. Disabled sending or failed fulfillment remains retryable. Stable provider keys and a frozen outbox payload protect retries. A pending provider outcome older than 23 hours requires reconciliation. Paying never changes what the public receipt shows.

## Response `200`

Accepted (or duplicate/ignored)

## Other responses

- `400`: Bad signature or body
- `409`: Conflicting business or customer identity; reconcile before retry
- `422`: Unsupported subscription price
- `503`: Unconfigured dependency or retryable fulfillment failure

---

[API](https://skmtc.dev/lodestarstamp/apis/lodestar-trust-api.md) · [All operations](https://skmtc.dev/lodestarstamp/apis/lodestar-trust-api/llms.txt) · [OpenAPI document](https://skmtc.dev/lodestarstamp/apis/lodestar-trust-api/revisions/af78368ab7a5?raw)