Epic

[balmy granite]

Can you share the code about how you retrieve the signature?

[west tangle]

$payload = @file_get_contents('php://input');
$sig_header = $_SERVER['HTTP_STRIPE_SIGNATURE'];
$event = null;

    try {
      $event = \Stripe\Webhook::constructEvent(
        $payload, $sig_header, $endpoint_secret
      );
    } catch(\UnexpectedValueException $e) {
      // Invalid payload
      http_response_code(400);
      exit();
    } catch(\Stripe\Exception\SignatureVerificationException $e) {
      // Invalid signature
      http_response_code(400);
      exit();
    }
    
    function fulfill_order($line_items) {
      // TODO: fill me in
      error_log("Fulfilling order...");
      error_log($line_items);
    }

    // Handle the checkout.session.completed event
    if ($event->type == 'checkout.session.completed') {
      // Retrieve the session. If you require line items in the response, you may include them by expanding line_items.
      $session = \Stripe\Checkout\Session::retrieve([
        'id' => $event->data->object->id,
        'expand' => ['line_items'],
      ]);

      $line_items = $session->line_items;
      // Fulfill the purchase...
      fulfill_order($line_items);
    }

    error_log("Passed signature verification!");
    http_response_code(200)

[balmy granite]

The PHP example code doesn't use any framework and the request headers can be read $sig_header = $_SERVER['HTTP_STRIPE_SIGNATURE'];

You'd need to replace this line with how a request header should be read in joomla framework