secure-payment-webhook-access

What problem does it solve?

This Skill ensures that payment webhook events are verified before granting access to purchases, preventing unauthorized access via client-side redirects or unreliable signals.

Core Features & Use Cases

• Signature verification for Stripe and Xendit webhooks before any body parsing or DB access.
• Idempotency checks to avoid duplicate grants on repeated webhook deliveries.
• Atomic transactions for state changes using prisma.$transaction to ensure consistency.
• Access gating only when Purchase.status is "COMPLETED" or an active subscription exists.
• Auditing and debugging workflows for common issues like "payment succeeded but user can't access resource".
• Guidance for implementing and auditing webhook handlers across Stripe and Xendit.

Quick Start

Audit and implement webhook handling to ensure signature verification, idempotency, transactional updates, and secure access gating after a completed purchase.