Stripe

Capture, inspect, and replay Stripe webhook events with Hookdrop.

Use Hookdrop as your Stripe webhook endpoint to inspect every event payload, verify signatures, and replay events during development — without exposing a local server.

Setup

1. Open Stripe webhook settings

   Go to the Stripe Dashboard and navigate to Developers → Webhooks.

2. Add an endpoint

   Click Add endpoint.

3. Paste your Hookdrop URL

   Enter your capture URL:

   https://hookdrop.dev/in/{your-token}
   

   Replace {your-token} with the token shown on your Hookdrop dashboard.

4. Select events

   Choose the events you want to capture. Start with payment_intent.succeeded and payment_intent.payment_failed to cover core payment flows.

5. Save the endpoint

   Click Add endpoint. Stripe will immediately send a test event — you’ll see it appear in your Hookdrop event list within seconds.

Common events

Event	When it fires
payment_intent.succeeded	A payment completes successfully
payment_intent.payment_failed	A payment attempt fails
customer.subscription.created	A new subscription is created
customer.subscription.deleted	A subscription is cancelled
invoice.paid	An invoice payment succeeds

Signature verification

Stripe signs every webhook request with a Stripe-Signature header. Verify it in your handler before processing any event.

stripe-webhook.ts

import crypto from 'crypto'

const verifyStripeWebhook = (
  payload: string,
  signature: string,
  secret: string
): boolean => {
  const elements = signature.split(',')
  const timestamp = elements.find(e => e.startsWith('t='))?.split('=')[1]
  const sig = elements.find(e => e.startsWith('v1='))?.split('=')[1]

  if (!timestamp || !sig) return false

  const signedPayload = `${timestamp}.${payload}`
  const expected = crypto
    .createHmac('sha256', secret)
    .update(signedPayload)
    .digest('hex')

  return expected === sig
}

Retrieve your webhook signing secret from Stripe Dashboard → Developers → Webhooks → [your endpoint] → Signing secret.

Always verify the signature before trusting the event payload. Skip verification only in local development — never in production.

Testing locally

Use your Hookdrop capture URL during local development instead of running ngrok. Every event appears instantly in your dashboard with full headers and body — no terminal session required.

When you’re ready to test a specific scenario, use the Replay button in Hookdrop to resend any captured event to your local handler.

Next: GitHub

Set up Hookdrop to capture GitHub webhook events including push, pull requests, and workflow runs.