Problem
Stripe webhook deliveries are signed correctly (Stripe-Signature), but the body is only { type, data: { object } }. For example, checkout-sessions.ts dispatches { type: "checkout.session.completed", data: { object: formatSession(...) } }.
A real delivery is an Event object (https://docs.stripe.com/api/events/object): id (evt_...), object: "event", created, api_version, livemode, pending_webhooks, request, type, data.object (and data.previous_attributes on updates).
Receivers deduplicate on event.id (Stripe documents duplicates and asks receivers to guard against them: https://docs.stripe.com/webhooks#handle-duplicate-events) and order on created. A receiver that refuses id-less events acknowledges every emulated delivery and applies none of them, so checkout-to-fulfilment flows cannot be tested end to end.
Reproduced on published emulate 0.12.2. The code is unchanged on main at 4c0422e.
Reproduction
- Seed a price and a webhook (
events: [checkout.session.completed], with a secret). - Create a Checkout Session and complete it (
POST /checkout/:id/complete). - Inspect the delivered body.
Actual: {"type":"checkout.session.completed","data":{"object":{...}}}.
Expected: an Event envelope with a unique evt_ id per event (the same id on a redelivery), object: "event", created in Unix seconds, api_version and livemode: false, with GET /v1/events/:id returning it as a bonus.
Activity
0No activity yet.