---
title: "Receive Lemon Squeezy checkout webhooks"
method: POST
path: "/v1/webhooks/lemonsqueezy"
---

# Receive Lemon Squeezy checkout webhooks

`POST /v1/webhooks/lemonsqueezy`

## Request

- Base URL: `https://api.uploadcheck.app`
- URL: `https://api.uploadcheck.app/v1/webhooks/lemonsqueezy`
- Auth: none required

Verifies Lemon Squeezy X-Signature with HMAC-SHA256 over the raw body using UPLOADCHECK_LEMONSQUEEZY_WEBHOOK_SECRET, then provisions paid subscription/order events into idempotent workspace API keys for MCP/API clients.

## Headers

- `X-Signature` string, required

## Request body

- object

## Response `200`

Webhook verified and ignored or idempotently replayed without bearer secret.

## Other responses

- `201`: Webhook verified and first-time API key provisioned.
- `401`: Invalid Lemon Squeezy signature.
- `503`: Webhook signing secret is not configured.

---

[API](https://skmtc.dev/uploadcheck/apis/uploadcheck-app-api.md) · [All operations](https://skmtc.dev/uploadcheck/apis/uploadcheck-app-api/llms.txt) · [OpenAPI document](https://skmtc.dev/uploadcheck/apis/uploadcheck-app-api/revisions/d7c8a14caa30?raw)