#un!t
granite goblet
steel snow
hello! when you try to create a restricted API key, you should select these permissions for the webhook
pseudo magnet
Thats just it? Because i am getting a 403, even with a key under STRIPE_WEBHOOK_SECRET env key
With webhook permission
this is the current api key
steel snow
do you have the request id where you're getting a 403?
pseudo magnet
webhook id: we_1LrJkLLwDjSXOsgWyWUAmYaZ
eventg id: evt_1Ls1KFLwDjSXOsgWuE1TlU58
does this help? 😄
steel snow
sorry, gimme a while, still looking into it
pseudo magnet
ok np
open venture
👋 taking over this thread. looking into it now
After having a look at evt_1Ls1KFLwDjSXOsgWuE1TlU58, 403 (forbidden) error is returned from your webhook endpoint to Stripe
pseudo magnet
Correct, can you show me what api key is getting returned?
I use one with the permission which alex said
but i am getting 403
but i dont get why i am getting 403
open venture
could you explain how you use this restricted key?
API key is only required during signature verification: https://stripe.com/docs/webhooks/quickstart
However, 403 (forbidden) error returned from you is likely before reaching to signature verification part.
API key doesn't play a role of returning 403 in this case
pseudo magnet
Oh okay, hmm i will take a look.
open venture
The HTTP 403 Forbidden response status code indicates that the server understands the request but refuses to authorize it [0]. I'd recommend checking why your server for webhook endpoint is not accepting Stripe events.
[0] https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403
pseudo magnet
yes, but i dont get a "error" server side
POST stripe/webhook ..................................... cashier.webhook › Laravel\Cashier › WebhookController@handleWebhook
the webhook route is registered
server time is Thu Oct 13 09:45:33 CEST 2022
what "time" does the webhook send?
because i saw, that there can be a issue with not matching timezones?
open venture
this event was retried a few times. you can refer to the timestamp of each retry here: https://dashboard.stripe.com/test/events/evt_1Ls1KFLwDjSXOsgWuE1TlU58
pseudo magnet
or i once got a error, that it cant verify the request because of time validation error of the request
open venture
403 is forbidden, so it's not even reaching to the verification part
pseudo magnet
okay, i will try to find why its not reaching the laravel application
can we leave this open, so i can comeback?
No signatures found matching the expected signature for payload
does this ring any bells?
open venture
Ah yes! This means that the event signature mismatch
Does 403 relate to this error?
open venture
great to see that it got resolved!
open venture
Yes! Webhook should use webhook secret instead of API key
Sorry that I didn't notice this earlier
pseudo magnet
no problem 🙂 "event signature mismatch" and a stack overflow post guided me in the right direction 😄
so thanks anyways 🙂
open venture
no problem! happy to see the issue got resolved!
pseudo magnet
nice support so far 😛 i cant recall by anymeans what that crypto dude says
maybe its his shady business? 😄
open venture
glad that you have nice experience with us 😄