Ship It Checklist

Checklists /Cursor or Claude Code, Next.js and Vercel /Payments

Critical

Verify the Stripe webhook signature

Marking an order paid because a request arrived is not enough. Anyone can POST fake JSON to that route. Stripe signs the raw body, and the signature only matches if you use the exact bytes and the endpoint's own secret.

How to check

  1. Find the webhook route. It should call constructEvent (or the current Stripe helper) with the raw body, the Stripe-Signature header, and the endpoint secret.
  2. The route must read the raw body. JSON parsing before verification breaks the signature.
  3. The secret must be the one for this endpoint. The Stripe CLI secret and the Dashboard secret are different.
  4. Send a test event from Stripe and confirm an order moves to paid only then.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this repository. Do not add features.

Goal: the Stripe webhook verifies the signature on the raw request body before it updates any order.

Steps:
1. Find the webhook route.
2. Read the raw body. In the App Router, that means the request text before any JSON parse.
3. Call stripe.webhooks.constructEvent with the body, the stripe-signature header, and STRIPE_WEBHOOK_SECRET.
4. Only after that succeeds, update the order for the event type you care about.
5. Do not print the webhook secret. Tell me to use the Dashboard signing secret in production, not the CLI secret.

This uses the same ticks as the checklist page, saved in this browser.

Related error fixes