Webhooks

app/api/webhooks/stripe/route.ts

import type Stripe from "stripe";
import { eq } from "drizzle-orm";
import { stripe } from "@/lib/stripe";
import { db } from "@/lib/db";
import { users, webhookEvents } from "@/lib/db/schema";

export async function POST(req: Request) {
  // 1. Raw body + signature header. Don't use req.json() here!
  const body = await req.text();
  const signature = req.headers.get("stripe-signature");
  if (!signature) return new Response("Missing signature", { status: 400 });

  // 2. Verify it really came from Stripe
  let event: Stripe.Event;
  try {
    event = stripe.webhooks.constructEvent(body, signature, process.env.STRIPE_WEBHOOK_SECRET!);
  } catch {
    return new Response("Invalid signature", { status: 400 });
  }

  // 3. Idempotency: record the event ID first; skip if we've seen it
  const inserted = await db
    .insert(webhookEvents)
    .values({ stripeEventId: event.id })
    .onConflictDoNothing()
    .returning();
  if (inserted.length === 0) return new Response("Duplicate", { status: 200 });

  // 4. Handle the events you care about
  switch (event.type) {
    case "checkout.session.completed": {
      const session = event.data.object;
      if (session.client_reference_id) {
        await db
          .update(users)
          .set({
            stripeCustomerId: session.customer as string,
            stripeSubscriptionId: session.subscription as string,
            subscriptionStatus: "active",
          })
          .where(eq(users.id, session.client_reference_id));
      }
      break;
    }
    case "customer.subscription.updated":
    case "customer.subscription.deleted": {
      const sub = event.data.object;
      await db
        .update(users)
        .set({ subscriptionStatus: sub.status })
        .where(eq(users.stripeCustomerId, sub.customer as string));
      break;
    }
    default:
      // Not interested: still say 200 so Stripe doesn't retry
      break;
  }

  return new Response("OK", { status: 200 });
}

lib/db/schema.ts (dedupe table)

export const webhookEvents = pgTable("webhook_events", {
  stripeEventId: text("stripe_event_id").primaryKey(),
  receivedAt: timestamp("received_at", { withTimezone: true }).defaultNow(),
});

Terminal

# Install (Homebrew, Scoop, and other options: docs.stripe.com/cli/install)
npm install -g @stripe/cli

# Log in to your Stripe account
stripe login

# Forward events to your local route (prints a whsec_... secret)
stripe listen --forward-to localhost:3000/api/webhooks/stripe

# In a second terminal: fire a test event
stripe trigger checkout.session.completed