weegloo-payment

Run all server-side payment logic inside a Weegloo Script. The frontend creates a pending order, a Script creates the checkout session with the PG, and a second Script confirms payment by calling the provider's verify API and comparing the amount against your stored order.

Extract the timestamp and v1 signature from the Stripe-Signature header with a Regex Capture statement, then run a Signature statement computing HMAC-SHA256 over '{timestamp}.{rawPayload}' keyed with the whsec_ secret in Utf8 encoding. Verify as the first statement and return 401 on failure.

It defaults to Stripe in test mode, building the entire checkout first and asking for your pk_test_ and sk_test_ keys last. If you name a provider like Toss Payments, Paddle, or PortOne, that provider is integrated instead and Stripe is never substituted.

Yes, by enabling anonymousCallEnabled on the Script and registering the /execute/anonymous endpoint. In that case the signature check is the only authentication, so it must run before any read or write, and the :self ownership filter cannot be used.

The most common cause is signing a re-serialized body instead of the raw payload bytes. Also avoid anchoring the regex with ^...$ since test events append a fake v0 scheme, and keep secretEncoding as Utf8 because the whsec_ prefix is part of the key.

No. It covers only a product charging its own customers through a PG or MoR. Weegloo's own subscription and plan billing is a separate system and is explicitly out of scope.