Webhooks

import express from 'express';
import { stripe } from './stripe';

app.post('/api/stripe/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  let event;
  try {
    event = stripe.webhooks.constructEvent(
      req.body,
      req.headers['stripe-signature'] as string,
      process.env.STRIPE_WEBHOOK_SECRET!,
    );
  } catch (err) {
    return res.status(400).send('invalid signature');
  }

  switch (event.type) {
    case 'checkout.session.completed':
      // mark the order paid, grant access
      break;
    case 'customer.subscription.deleted':
      // revoke access
      break;
    default:
      // other events are normal; ignore what you do not handle
  }
  res.json({ received: true });
});

import os
import stripe
from flask import request, abort

@app.post("/api/stripe/webhook")
def stripe_webhook():
    try:
        event = stripe.Webhook.construct_event(
            request.get_data(),
            request.headers.get("Stripe-Signature", ""),
            os.environ["STRIPE_WEBHOOK_SECRET"],
        )
    except Exception:
        abort(400)

    if event["type"] == "checkout.session.completed":
        pass  # mark the order paid, grant access
    return {"received": True}