Webhook fix guides

Short guides for the problems we see most. Each one ends with how to check your fix.

• Stripe webhook to a Supabase Edge Function returns 401

  Stripe gets a 401 from your Supabase Edge Function and your logs are empty? Supabase blocks it before your code runs. Here is the two-step fix.

• Your Stripe webhook works on your laptop but fails in production

  Your Stripe webhook passes with stripe listen but fails after deploy. Most of the time it's the wrong secret, an old deploy, a redirect or a login wall. Check them in order.

• Stripe webhook not firing

  A payment went through, but your webhook never ran? First check if Stripe tried to send it. Then fix the mode, the event types or a turned-off endpoint.

• Stripe webhook signature verification failed

  Getting 'No signatures found matching the expected signature for payload'? One of three inputs is wrong: the body, the header or the secret. Here is how to find which.

• Stripe webhook signature fails on Vercel Edge

  SubtleCryptoProvider cannot be used in a synchronous context on Vercel Edge? Use constructEventAsync with Stripe.createSubtleCryptoProvider, or switch the route to nodejs.

• Lemon Squeezy webhook says the signature is invalid

  Lemon Squeezy signs the raw request body with HMAC SHA-256 and sends the result in the X-Signature header. If you hash anything other than the exact raw text, the check fails.

• Lemon Squeezy webhook keeps retrying

  Lemon Squeezy keeps retrying your webhook? It only treats HTTP 200 as success. 201, 204 and crashes all get retried. Here is the fix.

• Lemon Squeezy webhook lost during a deploy

  A deploy or short downtime can last longer than Lemon Squeezy's four webhook tries. The order can still show as paid, but your app never unlocks the customer. Here is how to catch up.

• Paddle webhook signature verification failed

  Paddle says your webhook failed its signature check? It is almost always the body, the secret key or the 5-second clock. Here's how to find which one, step by step.

• Paddle webhook keeps retrying

  Paddle keeps sending the same webhook? It wants a 200 within five seconds. Slow work, cold starts and the wrong status all count as a fail. Here is the fix.

• PayPal webhook verification failed

  PayPal's webhook check says FAILURE? The body changed, the webhook ID is wrong, or it was a simulator event. Here is how to find which, with tested Next.js code.

• PayPal webhook not received

  Your PayPal webhook never arrives, or sits as Pending? Find out if PayPal made the event, tried to send it, or your app dropped it. With tested code.

• Your Lovable or Bolt app does not react to payments

  Apps built with tools like Lovable and Bolt often have a front end plus a few serverless functions. A webhook must point at a function. If it points at a page, the provider sees a happy reply and nothing runs.

• Paid in Stripe, but your Lovable or Bolt app didn't unlock

  Stripe says the payment worked, but your Lovable or Bolt app still shows the free plan. Here is how to find where the chain breaks and fix it.

• Your webhook answers with a 307 or 308 redirect

  Stripe shows 307 or 308 for your webhook? Stripe counts a redirect as a failed delivery. Find the final address and use it. Here's how.

• Stripe webhook returns 404 in Next.js (App Router)

  Stripe shows 404 for your Next.js webhook? The route is not where Stripe looks. Check the file name, the folder and the URL. Here's how, step by step.

• Stripe webhook blocked by Cloudflare (403 or "Just a moment")

  Stripe shows 403 for your webhook and your logs are empty? Cloudflare may be stopping it first. Find the rule that blocks it and let only that path through.

• Your Stripe webhook ran twice

  Stripe can send the same webhook event more than once. Save each event ID, skip repeats, and reply fast. Here is the fix, step by step.