OPopenmercantil
Billing
Integrations

Receive a signed Stripe event

Changed on

Provider callback, not an end-user API. The exact raw JSON body is capped at 512 KiB and verified against Stripe-Signature before durable inbox claim or side effects. Provider event.id supplies idempotency; terminal duplicates return 200, active leases return 503 for retry, and failures return 500 so Stripe retries. No webhook secret, signature, raw payload or internal exception is returned. This route is excluded from every public MCP surface.

post/api/v1/stripe-webhook

Request

Headers

Stripe-Signaturestring required

Stripe-generated signature verified over the exact raw body. It is sensitive request metadata and must never be logged or echoed.

Request body

idstring required

Provider event id and durable idempotency key.

object'event'
typestring required
createdinteger
livemodeboolean
api_versionstring nullable

Response

Event accepted, deliberately ignored, or already terminal. All response bodies are non-secret acknowledgements.

Changes