What is Stripe Webhooks?
Stripe Webhooks delivers account events to a registered HTTPS endpoint. The endpoint subscribes to chosen event types, and Stripe sends each matching event as a JSON Event object in an HTTP POST. A receiver might use payment_intent.succeeded to complete an order or invoice.paid to update a subscription ledger.
Every endpoint has its own signing secret, commonly identified by the whsec_ prefix. Stripe puts a timestamp and signatures in Stripe-Signature. Its libraries verify the delivery by passing the raw UTF-8 body, that header, and the endpoint secret to constructEvent(). A body parser that changes whitespace or JSON ordering will break this check.
Stripe asks endpoints to return a 2xx response before starting slow work. In live mode, it retries unsuccessful delivery for up to three days with exponential backoff. Sandbox events are retried three times over a few hours. Events can arrive more than once or out of order, and every retry receives a new signature and timestamp even though the Event ID remains the right key for deduplication.
A Stripe webhook reports an event from a Stripe account. It does not fetch website content, influence AI citations, or place pages in a model-training dataset. robots.txt applies to crawlers requesting site paths, not to an HTTPS callback configured by the account owner.
