Validate Stripe webhook signatures
Accept only events signed with the stored endpoint secret. The guide then takes you through the correct route, the checks to complete before making changes, the workflow in order, and the evidence to review afterwards.
Where to goTechnical endpoint → /ideal/webhook
Before you start
- Use the exact navigation above and confirm the intended invoice, case, client, property, document or environment.
- Verify module activation and the stated permission before attempting the action.
- Use a controlled test record for payments, emails, public/portal access, provider calls and deletion.
What you’ll accomplish
Accept only events signed with the stored endpoint secret. These instructions follow the supplied module’s live hooks, menus, controllers, forms, model rules and downstream effects.
Follow these steps
- Keep the signing secret current.
- Send only Stripe-generated events to the endpoint.
- Check invalid signatures return HTTP 400.
Fields and options to review
HeaderStripe-Signature
Secretideal_module_stripe_webhook_signing_secret
Category/help-centre/category/stripe-ideal-payment-gateway/
Topic/help-centre/topic/stripe-ideal-security-troubleshooting/
Rules the system enforces
- Webhook::constructEvent performs payload/signature validation.
How to confirm it worked
- Validate Stripe webhook signatures completes through the supplied module flow.
- Reopen the source record or settings page and verify the stored value, status, payment, file, timeline entry or notification.
Security, privacy and operational checks
- Protect credentials and invoice/payment data.
- Verify Stripe state before any retry or manual finance correction.
Continue with related guidance
Was this guide useful?Your response is stored only in this browser.