A clearer delivery trail for Stripe.

Create the endpoint

Create an endpoint in ShellOrbit and give it a name that identifies the provider and environment. Add your application’s public HTTPS handler as a destination.

Copy the ingest URL into Stripe’s webhook or notification configuration. Subscribe only to the event types your application needs.

Configure verification

In endpoint settings, choose Stripe and enter your webhook endpoint secret from Stripe. Select Quarantine for invalid signatures, then save and enable verification.

Verification reads Stripe-Signature and the original body. See the official Stripe verification instructions for provider-specific configuration.

Test delivery

Send a test event through the provider. Open Events in ShellOrbit, check the signature result, and inspect the destination’s response. Fix verification failures before enabling live traffic.

Verify forwarded requests

Your receiving handler should verify the fresh ShellOrbit signature. Original provider headers are useful evidence, but timestamped provider signatures may expire during retries and no longer match a transformed body.

Handle duplicate events

Use the provider’s event identifier in your application’s idempotency check. A transport failure or manual replay can deliver an event more than once.

Recover after an interruption

Inspect failed deliveries and use a recovery preview before starting a larger replay. Events that never reached ShellOrbit require recovery through the provider’s own tools; a relay cannot replay data it never received.

Browse every integration · Read about delivery guarantees

Watch your Stripe keys

A live Stripe secret key in browser code or a public repo is a direct path to your money. Leak Alarm looks for sk_live_ and restricted keys in the code your site sends to browsers, in the GitHub repos you connect, and in your logs, and alerts you with the fix. See Leak Alarm.