DEV Community

David Carr
David Carr

Posted on • Originally published at dcblog.dev on

Handle Stripe checkout webhooks

Handle Stripe checkout webhooks

Continuing on from my last post Sell products with Stripe let's first setup a webhook on stripe by going to Developers -> Webhooks https://dashboard.stripe.com/webhooks

Add a new webhook, provide a URL for the webhook to go to such as https://domain.com/webhooks/stripe

select the events to listen to since I'm dealing with the hosted checkout for one-off products I want the checkout session.checkout.completed event.

Once created click into the webhook and press reveal under signing secret to reveal the webhook API key. Add this key to your .env file


STRIPE_WEBHOOK_SECRET=
Enter fullscreen mode Exit fullscreen mode

Next open App/Http/Middleware/VerifyCsrfToken.php to whitelist an endpoint to allow Stripe to send POST requests in.


class VerifyCsrfToken extends Middleware
{
    /**
     * The URIs that should be excluded from CSRF verification.
     *
     * @var array
     */
    protected $except = [
        'webhooks/stripe',
    ];
}
Enter fullscreen mode Exit fullscreen mode

Create a route


Route::post('webhooks/stripe', [WebhooksController::class, 'collect']);
Enter fullscreen mode Exit fullscreen mode

In the controller create a method, set the stripe API key, secret and collect POST data using php//input

Then in a try-catch verify the webhook API key with Stripe.


public function collect()
{
    Stripe::setApiKey(config('services.stripe.secret'));
    $secret = config('services.stripe.webhook');
    $payload = file_get_contents("php://input");
    $sig_header = $_SERVER["HTTP_STRIPE_SIGNATURE"];
    $event = null;

    try {
        $event = Webhook::constructEvent($payload, $sig_header, $secret);
    } catch (\UnexpectedValueException $e) {
        // Invalid payload
        http_response_code(400);
        return true;
    } catch (SignatureVerification $e) {
        // Invalid signature
        http_response_code(400); // PHP 5.4 or greater
        return true;
    }

    // Handle the checkout.session.completed event
    if ($event->type === 'checkout.session.completed') {
        $this->handle_checkout_session($event);
    }

    http_response_code(200);
}
Enter fullscreen mode Exit fullscreen mode

Finally checking the $event->type matches the event checkout.session.completed all another method and pass in the event.

Inside the event drill down to the metadata which will contain any data sent to stripe, open you will put a user id and product in so you can process orders.


public function handle_checkout_session($eventData)
{
    $meta = $eventData->data->object->metadata;

    if (isset($meta->user_id)) {
        $purchase = Purchase::create([
            'user_id' => $meta->user_id,
            'product_id' => $meta->product_id,
            'data' => json_encode($eventData),
        ]);

        Mail::
            to($purchase->user->email)
            ->send(new PurchasedProduct($purchase));
    }
}
Enter fullscreen mode Exit fullscreen mode

In this case, I create a transaction log and send an email to the customer.

The important thing is in the collect method to respond to Stripe as quick as possible by sending an HTTP status code and after sending a response process the data.

Top comments (0)