Stripe webhooks

GiveLink receives Stripe events to update donation records, manage recurring giving, and trigger downstream work such as receipts and dispute alerts.

This is an inbound service endpoint operated by GiveLink. It does not provide public outbound webhook subscriptions for your application.

Endpoint

POST /api/webhooks/stripe

Stripe sends events to this endpoint. Nonprofit admins connect their account through the Stripe Connect workflow.

Signature verification

GiveLink reads the raw request body and verifies the Stripe-Signature header with the configured STRIPE_WEBHOOK_SECRET before processing the event. Missing or invalid signatures receive 400 Bad Request.

Processing and acknowledgment

For invoice.created, GiveLink runs renewal fee handling before handing the event to Inngest, the service that runs its background workflows. This allows eligible invoice fee updates to happen before acknowledgment.

GiveLink then sends the verified event to Inngest and waits for that handoff to succeed before returning 200 OK with { "received": true }. A failed handoff is not acknowledged as successful.

The response confirms the handoff. Background work, such as recording a donation and sending its receipt, can still be in progress.

Duplicate events

GiveLink uses the original Stripe event ID as the Inngest event ID to support duplicate-event detection. It does not keep the processed-event record in an in-memory set on the web server.

Background handlers have their own retry and record-update logic. An acknowledgment does not promise that every downstream action has completed or that an event can never be retried.