stripe-webhook-integration

What problem does it solve?

AI coding agents frequently implement Stripe webhook integrations for Rails apps with critical flaws: they skip signature and timestamp verification, ignore idempotency leading to duplicate processing, handle unnecessary event types, mix test and live webhook secrets, and process events synchronously causing timeouts and Stripe retries. These errors create security vulnerabilities, duplicate charges, and broken payment flows that are time-consuming to debug.

Core Features & Use Cases

• Secure Signature Verification: Enforces use of Stripe::Webhook.construct_event to validate webhook authenticity and timestamp in a single call.
• Idempotent Event Processing: Persists webhook events by unique event.id to prevent duplicate handling, with belt-and-suspenders guards in service objects.
• Curated Event Handling: Provides a pre-vetted list of common payment, subscription, and checkout events to handle, ignoring irrelevant events to reduce bug surface.
• Production-Grade Workflow: Includes async job processing with retries, environment-specific secret management, and local testing guidance via the Stripe CLI.
• Use Case: Rails teams building payment infrastructure can use this skill to ensure their Stripe webhook implementation follows senior Rails developer conventions, avoids common security and reliability pitfalls, and works correctly across development, staging, and production environments.

Quick Start

Use the stripe-webhook-integration skill to implement a secure, idempotent Stripe webhook endpoint for your Rails 8 app that correctly handles payment and subscription events with async processing and proper test/live secret separation.