Stripe webhook secret

You will leave with STRIPE_WEBHOOK_SECRET in .env and Vercel. This is not sk_. Checkout can succeed and your app still never hears about it without a webhook.

1Step 1: You need a URL first

A webhook is Stripe calling you. Localhost is not on the public internet.

• Local: Stripe CLI forwards to your machine.
• Production: your Vercel URL plus the route the app listens on, usually /api/webhooks/stripe.

Do not create a Dashboard endpoint pointed at localhost.

2Step 2: Local (CLI)

Install the Stripe CLI, then:

stripe login
stripe listen --forward-to localhost:3000/api/webhooks/stripe

The CLI prints a webhook signing secret starting with whsec_. That value is only for local listen. Put it in local .env as STRIPE_WEBHOOK_SECRET. It will not match production.

3Step 3: Production (Dashboard)

Developers → Webhooks → Add destination / Add endpoint.

• URL: https://YOUR-APP.vercel.app/api/webhooks/stripe (or the path your app actually uses)
• Events: start with checkout.session.completed. Add more later. Do not subscribe to everything on day one.

Reveal the signing secret. It starts with whsec_. Put it in Vercel as STRIPE_WEBHOOK_SECRET (Production). Redeploy.

.env.example:

STRIPE_WEBHOOK_SECRET=

A job that runs without you watching is Workers, after this secret verifies.