What it is
When someone pays, Stripe doesn’t just show a success screen. It sends your app a message behind the scenes (Stripe calls it a webhook) saying the payment went through. Your app reads that message and switches on the paid feature. The message comes with a signature that proves it really came from Stripe. Checking that signature is one line of code. Many AI-built apps skip it.
Without the check, your app believes any message that looks like it’s from Stripe. Anyone who knows the address your app listens on can send one.
What it looks like from your side
Your dashboard shows paying customers that Stripe has no record of. Or the other way round: Stripe has the payment, but the customer never got access, because the message was handled wrong and nobody noticed. Either way the first sign is a support email.
What it costs if you ignore it
People get paid features without paying, and you can’t tell which ones. Refund disputes get messy because your records and Stripe’s disagree. If the same message also handles cancellations, a fake one can cut off a paying customer.
How to check it yourself in 30 seconds
- Open your Stripe dashboard. Go to Developers, then Webhooks. You should see at least one entry pointing at your app’s address. If there are none, your app may be relying on the success screen alone, which anyone can fake.
- Click the entry. Stripe shows a signing secret for it, starting with
whsec_. Note whether it’s there. - Now open the settings for your app wherever it’s hosted, or in your AI tool’s settings page, and look at the list of saved secrets (often called environment variables). If none of them holds a
whsec_value, your app has nothing to check the signature with. - While you’re in Stripe, look at the entry’s recent deliveries. A long list of failures means Stripe is sending messages and your app isn’t handling them.
Reading these pages is safe. Don’t regenerate or delete anything while you look.
How I fix it
Every message from Stripe is checked against the signing secret before anything else happens, and anything that fails is thrown away. The same message arriving twice does no harm, because Stripe will resend. Paid features switch on from the verified message, never from the success screen.
I test it by sending a fake message and a repeated one.
Find out before your users do.
The Production Readiness Review is $250, takes 2–3 business days, and ends with a clear verdict: fix, restructure, or rebuild.
Book the $250 review