Source · Stripe · Verified November 1, 2026

Stripe webhook source guide

Short answer: A Hooks Stripe endpoint verifies Stripe-Signature as HMAC-SHA256 over <timestamp>.<raw body> with a five-minute tolerance, then normalizes each event to <resource>.<action> such as invoice.payment_failed.

Stripe events carry money-shaped fields that generic webhook tools flatten: amount, currency, customer, and a hosted invoice URL. Hooks keeps those on the subject, maps data.object.object to subject.kind, and deduplicates retried deliveries by the evt_ id.

Start for free Source to target guides

Set up the webhook in Stripe

In the Stripe Dashboard, open Developers → Webhooks → Add endpoint.
Paste the endpoint's ingestion URL and select the events you need (invoice, checkout, subscription).
Copy the endpoint's Signing secret (whsec_...) into the Hooks endpoint secret.
Send a test event from the Stripe Dashboard and confirm it in the delivery log.

Signature verification

Header	`Stripe-Signature: t=<timestamp>,v1=<hex>[,v1=...]`
Algorithm	HMAC-SHA256 over `<t>.<raw body>`; any matching v1 signature passes.
Replay window	Five minutes between `t` and the current time.
Delivery id	Body `id` when it starts with `evt_`, stable across Stripe retries.

The event type comes from X-Stripe-Event or the body type.
subject.title falls back through description, number, name, client_reference_id.
Hosted links are preferred: hosted_invoice_url, then receipt_url, url, short_url.

Events Hooks normalizes

event.type	subject	What it means
`invoice.payment_failed`	invoice	Invoice payment failed; amount and customer are mapped.
`invoice.payment_action_required`	invoice	SCA or manual action needed before the payment can complete.
`invoice.paid`	invoice	Invoice paid; amount_paid becomes subject.amount.
`checkout_session.completed`	checkout_session	Checkout finished; receipt or short URL becomes the subject URL.
`customer.subscription.created`	subscription	Subscription created for a customer.
`customer.subscription.deleted`	subscription	Subscription canceled; state reflects the final status.

Normalized payload

Every adapter produces this shape before filters or templates run. The raw payload and sanitized headers stay attached for audit, but filters and templates read the normalized fields.

Normalized event

{
  "id": "evt_01j9m6a1b2",
  "source": "stripe",
  "type": "invoice.payment_failed",
  "action": "payment_failed",
  "deliveryId": "evt_1PxYz2AbCdEfGhIj",
  "occurredAt": "2026-11-01T09:02:11.000Z",
  "actor": { "type": "application" },
  "subject": {
    "kind": "invoice",
    "id": "in_1PxYz2AbCdEfGhIj",
    "title": "Invoice INV-1042",
    "url": "https://invoice.stripe.com/i/acct_123/test_YWNjdF8x",
    "state": "open",
    "amount": 4900,
    "currency": "usd",
    "customer": "cus_PqRsTuVw"
  }
}

Filter and template examples

Filter: failed payments only

{
  "allow": [
    {
      "field": "event.type",
      "op": "in",
      "value": ["invoice.payment_failed", "invoice.payment_action_required"]
    }
  ]
}

Destination: Slack alert

{
  "mode": "chat",
  "token": "{{secret.SLACK_BOT_TOKEN}}",
  "channel": "C0123456789",
  "text": "Payment failed: {{event.subject.title}}\n{{event.subject.url}}"
}

Retries and the delivery log

408, 425, 429, and 5xx responses retry with backoff and honor Retry-After; other 4xx responses fail permanently with a named code. Every attempt keeps the rendered request and the target response, so a failure points at one field or one status instead of a guess.

Hooks delivery detail: attempt timeline, request payload, and the destination response for one delivery — Delivery detail: the attempt timeline, the rendered request the target received, and its response — the same record an event keeps for every destination.

Common errors

Symptom	Fix
`SIGNATURE_INVALID after replaying an old request`	Stripe signatures expire after five minutes. Send a fresh test event instead of replaying a captured request.
Wrong secret: `whsec_...` vs the Stripe CLI secret	The CLI prints its own secret. Use the endpoint's Signing secret from Developers → Webhooks for production deliveries.
`Amount looks 100x too large`	Stripe amounts are in the currency's minor unit. `4900` is $49.00; format it with the currency before display.

Pair with a target

Stripe to SlackAlert a Slack channel when Stripe payments fail: invoice.payment_failed filter, amount and customer in the message, and retries when Slack rate limits.Stripe to Grok BotSend failed Stripe invoices to a Grok Bot dunning routine: type filter, amount and customer fields, task template, and permanent 4xx vs retryable 5xx.All source to target guidesEvery combination built from this source, with filters and target configs.

Reference

Receiving eventshttps://hooks.events/docs/receive-events.md
Verify signatureshttps://hooks.events/docs/signatures.md
Payload templateshttps://hooks.events/docs/templates.md

Other sources

GitHubA Hooks GitHub endpoint verifies the X-Hub-Signature-256 HMAC on the raw body, stores the delivery, and normalizes each webhook into <event>.<action> (for example issues.opened) before any destination filter runs.SlackA Hooks Slack endpoint verifies X-Slack-Signature as HMAC-SHA256 over v0:<timestamp>:<raw body>, answers the url_verification handshake itself, and normalizes messages to app_mention.received or message.<channel_type>.LinearA Hooks Linear endpoint verifies Linear-Signature as hex HMAC-SHA256 over the raw body, rejects payloads whose webhookTimestamp is more than 60 seconds old, and normalizes events to issue.create, issue.update, and comment.create.SentryA Hooks Sentry endpoint verifies Sentry-Hook-Signature as hex HMAC-SHA256 with the Integration's Client Secret, deduplicates by Request-ID, and normalizes events to issue.created or event_alert.triggered.GitLabGitLab project webhooks cover pushes, merge requests, pipelines, issues, notes, and releases.ShopifyShopify app webhooks send topic-scoped events such as orders/create, products/update, and refunds/create.IntercomIntercom sends conversation and contact notification topics, signed with the app client secret.ZendeskZendesk webhooks cover ticket, user, and organization events, signed with a timestamp plus body HMAC.JiraJira Cloud webhooks cover issue creation, updates, comments, and sprint changes.PagerDutyPagerDuty v3 webhooks cover incident trigger, acknowledge, resolve, and annotation events.Standard WebhooksStandard Webhooks deliveries carry webhook-id, webhook-timestamp, and base64 v1 signatures.SvixSvix Play and the Svix dispatcher use the Standard Webhooks headers with svix- prefixes.VercelVercel webhooks cover deployment, integration, project, and domain events.TwilioTwilio status callbacks cover messages, calls, and recordings, signed over the URL and form parameters.DiscordDiscord interaction webhooks use Ed25519 signatures plus a PING handshake.Generic HMACGeneric sources sign timestamp.deliveryId.body with HMAC-SHA256 and send the signature in x-signature.BitbucketBitbucket Cloud repository webhooks cover pushes, pull request changes, and issue events.