.tip

A webhook endpoint that trusts whatever JSON it receives is an endpoint anyone can call. Every serious provider signs the payload with a shared secret.

const sig = req.headers.get("stripe-signature");
const event = stripe.webhooks.constructEvent(rawBody, sig, secret); // throws if wrong

Verify against the raw body bytes, not a re-serialised object, and reject anything with a timestamp more than a few minutes old so replays don't work.