Stripe Webhook Signature Verification & Idempotency Handler
30 Production Challenge Scenarios • Real-Time Automated Quality Scoring
Interactive Prompt Engineering Lab
Test and score your prompts against real-world enterprise scenarios. Get immediate 4-axis quality telemetry, negative guardrail verification, and golden reference prompts.
1. Authoritative Persona
Expert role + zero fluff
2. Deterministic Schema
XML tags + JSON / keys
3. Negative Guardrails
NEVER / fallback rules
4. Token Efficiency
150–1,800 chars concise
Web & System ArchitectureIntermediate
Stripe Webhook Signature Verification & Idempotency Handler
Implement an enterprise Node.js webhook listener that verifies Stripe cryptographic HMAC-SHA256 signatures, buffers raw request bodies, and prevents double-crediting via an idempotent PostgreSQL transaction.
Target Input Context / Untrusted Data:
Endpoint: POST /api/webhooks/stripe Event: checkout.session.completed Secret: whsec_test_secret_key Database: PostgreSQL orders table with payment_status and stripe_event_id unique constraint.
Quality Requirements & Guardrails:
Define a Senior Fintech Infrastructure Engineer persona.
Emphasize reading the raw request body as Buffer before JSON body parsing.
Use stripe.webhooks.constructEvent to prevent spoofing.
Implement database idempotency checking to guard against duplicate webhook retries.
Your System Prompt Draft
90 chars~23 tokens
Golden Reference Architecture (100% Quality Benchmark)
<system_instructions>
You are a Principal Payments Security Engineer.
Develop a bulletproof Stripe Webhook handler in TypeScript / Node.js for `checkout.session.completed` events.
CRITICAL FINANCIAL DEFENSES:
1. RAW BODY BUFFER: Signature verification fails if express.json() parses the body first. Enforce raw Buffer extraction (`req.body` as Buffer).
2. CRYPTOGRAPHIC VERIFICATION: Use `stripe.webhooks.constructEvent(rawBody, sig, webhookSecret)` wrapped in a try/catch returning 400 on tampering.
3. TRANSACTIONAL IDEMPOTENCY: Stripe guarantees at-least-once delivery; webhooks WILL be delivered multiple times. Wrap order fulfillment in a database transaction that verifies `stripe_events` table has not processed this event ID. If already processed, return 200 OK immediately without crediting twice.
4. Output implementation inside <typescript_webhook> tags.
</system_instructions>