How to validate Stripe payment success on backend

1const express = require('express');
2const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
3const app = express();
4
5// CRITICAL: Webhook route must use raw body
6app.post(
7  '/webhook',
8  express.raw({ type: 'application/json' }),
9  (req, res) => {
10    const sig = req.headers['stripe-signature'];
11    let event;
12
13    try {
14      event = stripe.webhooks.constructEvent(
15        req.body,
16        sig,
17        process.env.STRIPE_WEBHOOK_SECRET
18      );
19    } catch (err) {
20      console.error('Webhook signature verification failed:', err.message);
21      return res.status(400).send(`Webhook Error: ${err.message}`);
22    }
23
24    // Handle the event
25    switch (event.type) {
26      case 'payment_intent.succeeded':
27        handlePaymentSuccess(event.data.object);
28        break;
29      case 'checkout.session.completed':
30        handleCheckoutComplete(event.data.object);
31        break;
32      default:
33        console.log(`Unhandled event type: ${event.type}`);
34    }
35
36    res.json({ received: true });
37  }
38);
39
40// Regular routes use JSON parsing — AFTER webhook route
41app.use(express.json());

1function handlePaymentSuccess(paymentIntent) {
2  console.log('Payment succeeded:', paymentIntent.id);
3  console.log('Amount:', paymentIntent.amount, paymentIntent.currency);
4  console.log('Metadata:', paymentIntent.metadata);
5
6  // TODO: Fulfill the order
7  // - Update order status in your database
8  // - Send confirmation email
9  // - Grant access to digital product
10  // - Trigger shipping for physical product
11}
12
13function handleCheckoutComplete(session) {
14  console.log('Checkout completed:', session.id);
15  console.log('Payment status:', session.payment_status);
16  console.log('Customer email:', session.customer_details?.email);
17
18  if (session.payment_status === 'paid') {
19    // Fulfill the order
20  }
21}

1// Dashboard settings:
2// Endpoint URL: https://yoursite.com/webhook
3// Events to send:
4//   - payment_intent.succeeded
5//   - payment_intent.payment_failed
6//   - checkout.session.completed
7//   - checkout.session.expired
8
9// Copy the Signing secret (whsec_...) to your environment variables

1# Install Stripe CLI (macOS)
2brew install stripe/stripe-cli/stripe
3
4# Login to your Stripe account
5stripe login
6
7# Forward events to your local server
8stripe listen --forward-to localhost:4000/webhook
9
10# The CLI prints a webhook signing secret (whsec_...).
11# Use THIS secret for local testing, not the Dashboard one.
12
13# In another terminal, trigger a test event:
14stripe trigger payment_intent.succeeded

1const processedEvents = new Set(); // Use a database in production
2
3app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
4  // ... signature verification ...
5
6  // Idempotency check
7  if (processedEvents.has(event.id)) {
8    return res.json({ received: true }); // Already processed
9  }
10  processedEvents.add(event.id);
11
12  // Process the event...
13  res.json({ received: true });
14});