Internal

Stripe webhook receiver — the single writer of billing state after checkout

Called by Stripe, not a person or agent: authenticated by the stripe-signature header (an HMAC over the raw body, verified against STRIPE_WEBHOOK_SECRET) rather than a Tre bearer token or web session. 404s when billing is not configured on this installation (self-host); 503 when the installation has a Stripe key but no webhook secret configured yet.

post/api/webhooks/stripe

Request

  • Base URL: https://tre-app.com
  • URL: https://tre-app.com/api/webhooks/stripe
  • Auth: none required

Headers

stripe-signaturestring required

HMAC-SHA256 signature Stripe computes over the raw request body and a timestamp; the entire authentication for this route.

Response

Success

receivedtrue required
replaytrue

True when this event id was already processed (idempotent replay).

Changes

No recorded changes to this operation across all 1 revision of this API.