jude-webhooks | Stripe Developers | Page 1

unkempt monolith Sep 17, 2021, 3:53 PM

#

hello, have you pasted in the correct webhook signing secret into your webhook handler code?

wheat wren Sep 17, 2021, 3:58 PM

#

I'm pretty sure I have

#

is there any way I can check if its the correct one

#

I am trying to make sure its correct currently

unkempt monolith Sep 17, 2021, 4:03 PM

#

yeah you compare it to what you have in the Stripe Dashboard (I assume you set up your webhook endpoint in the Dashboard and not Stripe CLI)

wheat wren Sep 17, 2021, 4:03 PM

#

yeah I have one set up under "Endpoints receiving events from your account"

#

and that's the wh secret i have used

unkempt monolith Sep 17, 2021, 4:09 PM

#

what code are you using? paste just your webhook endpoint function here

wheat wren Sep 17, 2021, 4:11 PM

#

@app.route('/stripe-webhook', methods=['POST'])
def stripe_webhook():
# You can use webhooks to receive information about asynchronous payment events.
# For more about our webhook events check out https://stripe.com/docs/webhooks.
webhook_secret = os.environ.get('STRIPE_WEBHOOK_SECRET')
request_data = json.loads(request.data)

if webhook_secret:
    # Retrieve the event by verifying the signature using the raw body and secret if webhook signing is configured.
    signature = request.headers.get('stripe-signature')
    try:
        event = stripe.Webhook.construct_event(
            payload=request.data, sig_header=signature, secret=webhook_secret)
        data = event['data']
    except Exception as e:
        print(e)
        traceback.print_exc()
        return e
    # Get the type of webhook event sent - used to check the status of PaymentIntents.
    event_type = event['type']
else:
    data = request_data['data']
    event_type = request_data['type']

#

That's the main part of it that the problem is coming from (I think)

#

Theres more code to the webhook endpoint but its just to handle different event types

unkempt monolith Sep 17, 2021, 4:15 PM

#

you can log out webhook_secret and it is getting the right signing secret from your environment variable?

don't need to paste it here, just confirming

wheat wren Sep 17, 2021, 4:16 PM

#

I'll check , 2 seconds

#

yes

#

the webhook secret is as expected

unkempt monolith Sep 17, 2021, 4:18 PM

#

so I'm not Python expert but

            event = stripe.Webhook.construct_event(
                payload=request.data, sig_header=signature, secret=webhook_secret)

shouldn't that be passing payload=request_data ?

going off of https://stripe.com/docs/webhooks/signatures#verify-official-libraries

Check the webhook signatures

Verify the events that Stripe sends to your webhook endpoints.

#

on top of that I would also log out signature in your code to make sure it is getting the header

wheat wren Sep 17, 2021, 4:19 PM

#

yes I have logged out signature and it seems to get it

#

it could be request_data

#

I just copied the code from

#

https://stripe.com/docs/billing/subscriptions/elements#webhooks

Create subscriptions with Elements

Learn how to offer multiple pricing options to your customers and charge them a fixed amount each month.

#

which has it with .data

#

I'll try what you said 2 seconds

#

it does make sense

unkempt monolith Sep 17, 2021, 4:21 PM

#

I would try the doc I linked for now, I do see the dos are kinda different between the two though, so just trying to rule out which one works and why the other does not (if it is a code snippet issue)

wheat wren Sep 17, 2021, 4:21 PM

#

unkempt monolith so I'm not Python expert but ``` event = stripe.Webhook.construct_e...

I had tried to use this code instead for getting the signature but I got an error with the use of "META"

wheat wren Sep 17, 2021, 4:21 PM

#

wheat wren I had tried to use this code instead for getting the signature but I got an erro...

*I did this earlier

#

I still get the error when using request_data instead of request.data

unkempt monolith Sep 17, 2021, 4:26 PM

#

yeah I think you need to do request.data my bad

#

hmm wait

#

so this guide https://stripe.com/docs/webhooks/signatures#verify-official-libraries

says to use request.body so let's try that fully (comment out your current code just in case) and use this one

Check the webhook signatures

Verify the events that Stripe sends to your webhook endpoints.

wheat wren Sep 17, 2021, 4:29 PM

#

okay but I will get the signature the same way as I don't think request.META works for Flask

#

seems to be for Django

#

Yeah I get "AttributeError: 'Request' object has no attribute 'body'"

unkempt monolith Sep 17, 2021, 4:33 PM

#

ah you're using Flask

wheat wren Sep 17, 2021, 4:33 PM

#

I think this is becuase the request object seems to be different for Django

#

most documentation is for flask

unkempt monolith Sep 17, 2021, 4:33 PM

#

ok then most of the Django stuff would not be very relevant esp the syntax

wheat wren Sep 17, 2021, 4:33 PM

#

but that specific one is Djanho

#

yeah

#

I have the same endpoint

#

receiving events from connect applications as well as from my account

#

so the webhook secret is different

#

depending on which account

#

I think

#

although

#

It still doesn't seem to work

unkempt monolith Sep 17, 2021, 4:46 PM

#

hmm how do you know which webhook secret to use?

#

like how do you know if it is a Connect webhook event vs an Account webhook event

#

I assume you're probably looking at something in the event body first, then deciding?

wheat wren Sep 17, 2021, 4:47 PM

#

tbh I didn't know I had to distinguish them

#

So I hadn't been

#

but looking at them on the dashboard I can see different events being sent

#

and ofc the related webhook secret is different depending on who sent it

unkempt monolith Sep 17, 2021, 4:48 PM

#

for simplicity, I would keep it two different endpoints

#

or disable one and keep the other

#

and build your webhook handler code against only one endpoint first

#

and get that working

wheat wren Sep 17, 2021, 4:49 PM

#

Yeah I thought it was working the other night when I tested the subscriptions

unkempt monolith Sep 17, 2021, 4:49 PM

#

you might have to dig into Flask docs for how you reference the event body or how you reference the HTTP headers etc

wheat wren Sep 17, 2021, 4:51 PM

#

I can get the signature object etc

#

that seems to work as expected because I logged it

#

it just seems to not match the wh secret

#

I'm going to try check if it's just because of the connect account thing

unkempt monolith Sep 17, 2021, 4:53 PM

#

yeah I would isolate to only one webhook endpoint (and disable the other) to narrow it down further

wheat wren Sep 17, 2021, 4:54 PM

#

I think that is my problem yes

#

I didn't realise that it worked like that sorry

#

I'll have to create two webhook endpoints

#

and distinguish

#

I'll try implement that and see how it goes, Thanks for your help!

unkempt monolith Sep 17, 2021, 4:54 PM

#

all good! yeah easy thing to miss but ideally you have separate endpoints for both, Connect and Account webhooks

#jude-webhooks