Stripe Webhook Event Handling Plan for Developers
Specify how an app should react to payment events.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
[VERIFY] is an editorial flag, not a blank to fill. Wherever the prompt shows [VERIFY], check that item against a reliable source before you use it.
Write a specification for handling Stripe webhooks in my application, as defensive design. Language and framework: [STACK]. Events I care about (checkout completed, payment succeeded, payment failed, subscription updated or cancelled, refund created, dispute created): [EVENTS]. What the app must do for each: [ACTIONS]. Present a table of events. For each describe the data needed, the action, the idempotency rule (store processed event IDs so a repeated event does nothing), the order issue (events can arrive out of order; fetch the current object state when needed), the failure behaviour (return an error so Stripe retries, or log and alert), and the test. Verify the signature of every request using the signing secret held in secure configuration, never in code or in this chat [VERIFY with Stripe's documentation]. Log without card data, and avoid logging full payloads with personal data. Test plan using test mode and the CLI to send test events [VERIFY], and monitoring for failed deliveries. Mark API and event names [VERIFY against current Stripe documentation] and list questions for security review.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into ChatGPT, Gemini, Claude or another assistant.