---
title: "Stripe webhook receiver for one published app (Stripe only)"
method: POST
path: "/public/playground/stripe-webhook/{token}"
tags: ["app-data"]
---

# Stripe webhook receiver for one published app (Stripe only)

`POST /public/playground/stripe-webhook/{token}`

## Request

- Base URL: `https://api.onplana.com/api`
- URL: `https://api.onplana.com/api/public/playground/stripe-webhook/{token}`
- Auth: none required

The per-app endpoint a builder registers in their OWN Stripe dashboard. The URL is per-app by necessity: signature verification needs that app's signing secret, so the path token identifies the app before verification runs. Every event is verified against the bound secret, deduped on Stripe's event id, and granted only when it matches a Payment Link the owner bound. Not for direct use , listed so the contract is discoverable.

## Path parameters

- `token` string, required

## Response `200`

Processed (or a duplicate that was already settled).

## Other responses

- `400`: Signature verification failed , Stripe retries.
- `429`: Rate limited , Stripe retries.
- `500`: Transient failure , Stripe retries and the event is re-applied.
- `503`: No signing secret bound yet , Stripe retries.

---

[API](https://skmtc.dev/onplana/apis/onplana-api.md) · [All operations](https://skmtc.dev/onplana/apis/onplana-api/llms.txt) · [OpenAPI document](https://skmtc.dev/onplana/apis/onplana-api/revisions/c3d6c89e9dc8?raw)