Stripe Webhook Quick-Check — 7-point self-audit

Free — no payment needed

The 7 checks

• Webhook signature verification — you actually call stripe.webhooks.constructEvent with the raw body, not a parsed/re-serialized one.
• Raw-body parsing — your framework doesn't run a JSON body-parser before the webhook route (this alone breaks signature checks).
• Hardcoded secrets — no sk_live_ or whsec_ committed to the repo, even in test files or old commits.
• Idempotency keys — retried webhooks (Stripe retries on any non-2xx) don't double-fulfill an order.
• Legacy Charges API — new integrations use PaymentIntents, not the deprecated Charges API.
• Client-trusted amounts — the amount charged comes from your server/database, never from a value the client sent.
• Duplicate events — you dedupe on event.id, since Stripe can deliver the same event more than once.

This used to be a $2 CSV download. We dropped the paywall: at that price it wasn't worth anyone's checkout friction, and the 7 checks are more useful sitting here in the open where they can be read and shared.

Want more than a self-check?

Someone reads your actual code

If you'd rather have a human go through your real Stripe integration — not just this list — the $39 done-for-you audit covers your repo directly with file/line references and fixes.

Selling into an EU market and need to know what's legally exposed, not just what's broken in Stripe? See the EAA/WCAG $99 report.