Validate Stripe webhook signatures
Pixie CRM guidance. Follow the route for your workspace, check your role and enabled modules, and verify the result before moving on.
Accept only events signed with the stored endpoint secret.
Where to goTechnical endpoint → /ideal/webhook
Before you start
- Use the exact navigation above and confirm the intended invoice, case, client, property, document or environment.
- Verify module activation and the stated permission before attempting the action.
- Use a controlled test record for payments, emails, public/portal access, provider calls and deletion.
What this guide helps you do
Accept only events signed with the stored endpoint secret. These instructions follow the supplied module’s live hooks, menus, controllers, forms, model rules and downstream effects.
Follow these steps
- Keep the signing secret current.
- Send only Stripe-generated events to the endpoint.
- Check invalid signatures return HTTP 400.
Fields and options
HeaderStripe-Signature
Secretideal_module_stripe_webhook_signing_secret
Category/help-centre/category/stripe-ideal-payment-gateway/
Topic/help-centre/topic/stripe-ideal-security-troubleshooting/
Rules and limits
- Webhook::constructEvent performs payload/signature validation.
Check it worked
- Validate Stripe webhook signatures completes through the supplied module flow.
- Reopen the source record or settings page and verify the stored value, status, payment, file, timeline entry or notification.
Security, privacy and operational checks
- Protect credentials and invoice/payment data.
- Verify Stripe state before any retry or manual finance correction.
Related guides
Was this guide useful?Your response is stored only in this browser.