For apps that take payments
When someone pays you, Stripe, Lemon Squeezy or Paddle sends your app a message called a webhook. If it doesn't get through, the customer has paid and your app never finds out. Paste your webhook address and we'll check it in a few seconds.
yourapp.com/api/webhooks/lemonsqueezy · scanned Oct 25, 2026
This is our own endpoint, not a customer's.
The payment shows up in your provider's dashboard and the money arrives, so everything looks fine. But if the webhook didn't reach your app, the customer gets no access, no license key, no upgrade. Often the first you hear of it is a support email, or a chargeback.
The address your payment provider sends messages to. No account, no API keys.
We send a few test requests, like a provider would, and watch what your app answers, where it redirects and how fast it replies. We never send real payment events.
Each problem says what we saw, why it stops payments and what to change. Fix it and check again.
The common reasons a payment message never reaches your app.
A login page, a token check or a bot filter that turns your payment provider away before your code runs.
Your app should refuse a message with a fake signature. We check that it does.
A 301, 302, 307 or 308 can make a provider drop the event.
404 not found, or 405 when POST is not allowed.
5xx errors, and replies that take too long.
Plain http, bad certificates and certificates about to end.
We never see your signing secret, so we can't send a real signed event. A clean result means your address answers correctly. Do one real test payment to be fully sure.
Every finding says what we saw, why it matters and what to change. This one is a made-up example.
Some tips are written by AI. Those are marked, and they are short. The fix steps come from fixed templates, so you always get an answer.
yourapp.com/api/webhook
ExamplePayments may not be reaching your app
Your payment provider would be blocked before it reaches your code.
We found 1 thing to fix. Start with the first one.
Supabase Edge Functions ask for a login token by default. Payment providers do not send one, so every webhook gets a 401 and is lost.
We sent a request with a fake signature and it was refused.
The certificate checks out.
You built your app with an AI tool and it takes payments. You want to know the payment message really arrives.
You ship alone. You do not have time to read provider docs line by line.
You changed hosting or a domain and want proof the webhook still works.
The check is free and needs no account. A Deep Scan costs $9, paid once. It tests more, gives you fix steps for your setup and lets you re-scan 3 times in 7 days to confirm the fix worked.
Find out in seconds.
$0
Exact fixes for your app, and proof they worked.
$9 once
$9, paid once. Nothing renews. Your Deep Scan starts as soon as you pay and runs only on a domain you've shown is yours. If it fails because of a problem on our side, we run it again for free or refund you. Prices are in US dollars. Paid deep scans open at launch.
Tillping checks the payment webhook path of your app. A webhook is the message your payment provider sends when someone pays. We send safe test requests to your public webhook address. Then we tell you, in plain words, if something would stop the real messages from getting through.
The test requests are not real payment events. They carry a clearly marked test body. Your endpoint should reject them, because they have no valid signature. If your endpoint accepts them, we flag that as a problem. Only scan addresses you own or are allowed to test. Deep scans only run on domains you have proven you own.
No. We never ask for API keys, webhook secrets or passwords. Please never send them to us, not even in a support message. If you pasted one somewhere by mistake, rotate it in your payment provider.
A Deep Scan sends more requests than the free check, so we only run it on apps you control. Add a small file or a DNS record once and you're done.
You type your webhook address. We send a few test requests. For example, a POST with no signature, a POST with a fake signature, and a GET. We also follow redirects and check the HTTPS certificate and the reply time. Then we show what your endpoint answered, with a plain explanation and fix steps for each finding.
Your endpoint refused our test as not allowed. For a webhook that can be right, because it should refuse requests without a valid signature. It is a problem when the block comes from something in front of your code, like a platform login wall or a JWT check. Then your payment provider's real messages are refused too. Tillping tells these two cases apart when it can.
Not fully. A full check needs your signing secret, and we never ask for it. We can show that your endpoint is reachable and that it rejects unsigned and fake-signed requests. We cannot prove that valid signed events are accepted.
Each finding has a short reason and fix steps. The labels (Fix now, Fix soon, Minor) are guidance, not a promise. A clean scan means we found no problems in the checks we ran. It does not mean your whole payment flow is correct.
The free check tells you whether your webhook answers the way a payment provider expects. A Deep Scan runs more tests, works out how your app is built, gives you fix steps for it and lets you re-scan 3 times in 7 days. It's $9, paid once.
Your Deep Scan starts as soon as you pay, because you ask us to start it right away. Until it has run and your report is ready, you can cancel within 14 days for a full refund. Once it has run, it can't be cancelled. If it fails because of a problem on our side, or doesn't do what we described, we run it again for free or refund you, whichever you prefer. Your legal rights aren't affected. Write to support@tillping.online with your order number. Full details are in the Refund Policy.
One email to confirm, then a short tip now and then. Leave any time.
