javascript 39 lines · 7 steps

Handling Stripe webhooks in Next.js

A Next.js route handler that verifies Stripe webhook signatures and dispatches on event type.

Explained by highlit

Next.js Intermediate webhooks signature verification payment processing route handlers event dispatch

1import { NextResponse } from 'next/server';
2import Stripe from 'stripe';
3import { headers } from 'next/headers';
4 
5const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);
6 
7export async function POST(request) {
const body = await request.text();
const signature = (await headers()).get('stripe-signature');
10 
let event;
try {
  event = stripe.webhooks.constructEvent(
    body,
    signature,
    process.env.STRIPE_WEBHOOK_SECRET
  );
} catch (err) {
  console.error(`Webhook signature verification failed: ${err.message}`);
  return NextResponse.json({ error: 'Invalid signature' }, { status: 400 });
}
22 
switch (event.type) {
  case 'checkout.session.completed': {
    const session = event.data.object;
    await fulfillOrder(session.client_reference_id, session.payment_intent);
    break;
  }
  case 'invoice.payment_failed': {
    const invoice = event.data.object;
    await flagPastDue(invoice.customer);
    break;
  }
  default:
    console.log(`Unhandled event type: ${event.type}`);
}
37 
return NextResponse.json({ received: true });
39}

01 / 01

STEP 01

Walkthrough

Space play ←→ step click any line

Three takeaways

1Always verify webhook signatures against the raw request body before trusting any payload.
2Webhook endpoints should switch on event type and acknowledge with 200 once accepted.
3Read the body as raw text, not JSON, so the signature check sees the exact bytes Stripe signed.

Related explainers

javascript

const ROLE_PERMISSIONS = {
  admin: ['users:read', 'users:write', 'billing:read', 'billing:write'],
  manager: ['users:read', 'billing:read'],
  member: ['users:read'],

Role-based permissions middleware in Express

authorization middleware rbac

Intermediate 9 steps

javascript

function attachThousandSeparators(input, { locale = 'en-US' } = {}) {
  const formatter = new Intl.NumberFormat(locale);
  const groupSep = formatter.format(11111).replace(/\d/g, '')[0] || ',';
  const decimalSep = formatter.format(1.1).replace(/\d/g, '')[0] || '.';

Live thousand separators without losing the caret

dom intl caret-preservation

Advanced 8 steps

javascript

import { useReducer, useEffect } from "react";
 
const initialState = { status: "idle", data: null, error: null };

Building a data-fetching hook in React

custom-hooks usereducer data-fetching

Intermediate 9 steps

javascript

const express = require('express');
const app = express();
 
app.get('/health', (req, res) => res.json({ status: 'ok' }));

Graceful shutdown in an Express server

graceful-shutdown signal-handling connection-tracking

Advanced 9 steps

javascript

import { useState, useEffect, useCallback } from 'react';
 
function getColumnCount(width) {
  if (width < 640) return 1;

A responsive column hook in React

custom-hooks debouncing responsive-design

Intermediate 7 steps

javascript

function initCharacterCounter(textarea, options = {}) {
  const maxLength = options.maxLength ?? 280;
  const warnThreshold = options.warnThreshold ?? 0.9;