Security, limitations and troubleshooting

Stripe iDEAL Payment Gateway

Validate Stripe webhook signatures

Accept only events signed with the stored endpoint secret.

Understand the webhook CSRF exclusion

Limit the CSRF exclusion to the inbound Stripe endpoint.

Protect Stripe API keys

Keep secret and publishable keys separated and environment-matched.

Troubleshoot an invalid Stripe key

Use the exact provider exception displayed on the gateway tab.

Troubleshoot an iDEAL payment that is not recorded

Check callback, webhook, transaction ID and CRM addPayment outcome before retrying.

Understand the gateway key-check implementation caveat

Know that the internal helper returns true when the stored secret is empty.

Understand the create-webhook authorisation limitation

Record that create_webhook lacks an explicit capability check.

Understand unsupported refunds

Use Stripe/core CRM refund controls because the module provides no refund action.

Understand unsupported non-EUR payments

Use another gateway for invoices requiring another currency.

Understand unsupported webhook events

Do not expect failed, cancelled, refunded or chargeback events to be processed.

Understand the absence of module cron automation

Know that no scheduled job is registered by Stripe iDEAL V2.

Understand the absence of an iDEAL report

Use core invoice payments and Stripe Dashboard for reporting.

Understand bank selection ownership

Know that Stripe embedded Checkout—not the CRM module—presents eligible iDEAL bank/payment steps.

Troubleshoot a missing webhook warning

Confirm the gateway is active and has a secret key before expecting the check.

Troubleshoot a webhook ID mismatch

Recreate the endpoint after confirming environment and URL.

Troubleshoot a disabled webhook

Enable the endpoint with settings permission or in Stripe Dashboard.