Verify every webhook before processing it
Treat the raw request body and provider signature as the authority. A JSON payload posted by an arbitrary caller must not be able to grant a subscription, credits or access.
Keep endpoint secrets in server-side configuration and separate test and live environments.
- Reject missing and invalid signatures
- Use the raw request body required by signature verification
- Separate test and production secrets
- Log event identifiers without logging sensitive payloads unnecessarily
Make processing idempotent
Payment providers retry events. Your system should record the provider event identifier or enforce an equivalent unique business operation before applying side effects.
Test concurrent delivery as well as a simple sequential retry. Two workers can process the same event before either one records completion.
- Deliver the same event twice
- Deliver duplicates concurrently
- Add a unique constraint around the applied event or operation
- Ensure emails, credits and invoices are not duplicated
Test the complete subscription lifecycle
Access should reflect authoritative subscription and invoice state rather than a browser redirect. Test trials, failed renewals, cancellation at period end, immediate cancellation, upgrades, downgrades and refunds.
- Close the browser before the success redirect
- Delay webhook delivery
- Refund a successful payment
- Cancel and then reactivate
- Fail a renewal and verify the grace-period policy
Design customer recovery
Users need a safe path when a payment is pending, requires another action or succeeds while the redirect fails. The interface should not invite repeated purchases simply because confirmation is delayed.
- Refresh the confirmation page
- Interrupt the network after checkout
- Retry from two tabs
- Confirm receipts and support references are available
Authoritative references
Have experienced reviewers test the real application.
AuditFlare validates findings across your product, code and business logic, then explains what to fix.
Explore the payment-flow audit →