PayHook is in early access: the signature-verification core is built and tested; the hosted app ships in 4–6 weeks. Pre-order now — full refund anytime, no questions asked: just email [email protected].
acme-saas/Production
payhook.co/in/3f6c1d9b
Live
EventsAllFailed 2
invoice.paidStripe · 12:41:07500
customer.subscription.updatedStripe · 12:40:59200
transaction.completedPaddle · 12:32:14200
order.paidPolar · 12:18:40401
order_createdLemon Squeezy · 12:02:03200
payment.succeededDodo Payments · 11:57:22200
checkout.session.completedStripe · 11:41:10200
subscription.createdPaddle · 11:20:48200
subscription.activePolar · 10:58:31200
invoice.paidStripeevt_1QK3r2EiF7wLp9
ReplayCopy fix prompt
DiagnosisPayloadHeadersResponse
SignatureVerifiedReally from Stripe, 0.4 s old
Your endpoint500 in 3.2 sPOST /api/webhooks/stripe
Where it brokeYour handlerNot Stripe, not the secret
What happened
Stripe sent a real invoice.paid, but your handler crashed before it answered. It reads invoice.subscription.id, and on this invoice subscription is empty. The customer paid $29.00 and never got access.
Fix prompt
# Stripe webhook invoice.paid answers 500 (POST /api/webhooks/stripe).
# The handler reads invoice.subscription.id, but subscription is empty here.
Find the subscription safely, grant access, and always answer 200 after it.
Copy for CursorCopy for Claude CodeIncludes payload and response
order.paidPolarmsg_2mX8QfVbK1pL0rTz
ReplayCopy fix prompt
DiagnosisPayloadHeadersResponse
SignatureVerifiedSigned with your live secret
Your endpoint401 in 38 msPOST /api/webhooks/polar
Where it brokeWebhook secretYour app checks another one
What happened
Polar signed order.paid with your live secret and PayHook verified it. Your app answered 401, so it checks the signature with another secret, most likely the sandbox one. Every real payment gets rejected.
Fix prompt
# Polar webhook order.paid answers 401 (POST /api/webhooks/polar).
# The event is signed with the live secret, but the app verifies it with another one.
Use the live endpoint secret in production and keep the sandbox one for local runs.
Copy for CursorCopy for Claude CodeIncludes payload and response
transaction.completedPaddleevt_01j9k2m4r8qzt7w3
ReplayCopy fix prompt
DiagnosisPayloadHeadersResponse
SignatureVerifiedReally from Paddle, 0.2 s old
Your endpointNo answer in 10 sPOST /api/webhooks/paddle
Where it brokeSlow handlerIt works before it answers
What happened
Paddle sent a real transaction.completed. Your handler sends the welcome email before it answers, the email call hung, and the request timed out before access was granted.
Fix prompt
# Paddle webhook transaction.completed times out (POST /api/webhooks/paddle).
# The handler sends the welcome email before it answers.
Grant access, answer 200 right away, and send the email from a background job.
Copy for CursorCopy for Claude CodeIncludes payload and response
The problem
Webhook bugs are silent.Every clue is somewhere else.
Stripe shows the charge. Your database shows a user on the free plan. There is no error anywhere, until the customer writes to you.
Your server log
StripeSignatureVerificationErrorNo signatures found matching the expected signature for payload. Are you passing the raw request body you received from Stripe? at validateComputedSignature
An error that explains nothing
Test secret in production, a parsed body instead of raw bytes, or a stale timestamp. The message never says which.
Five ways to sign
Stripestripe-signature
Paddlepaddle-signature
Lemon Squeezyx-signature
Polarwebhook-signature
Dodo Paymentswebhook-signature
Five providers, five schemes
Each one signs, retries and times out in its own way. Stripe CLI only speaks Stripe.
https://4f2a-81-95.ngrok-free.apptunnel restarted, new URL:https://9c1e-77-12.ngrok-free.appLovableBoltVercelno localhost
No localhost in the cloud
Apps built on Lovable or Bolt have nothing to forward to, and every tunnel restart means a new URL in every dashboard.
Paid users stay on the free plan. Why?
AssistantIt could be the webhook secret, the endpoint URL or the event type. Can you check your Stripe dashboard?
Your AI is guessing too
Cursor and Claude Code wrote the handler, but they never see the event that broke it.
How it works
One URL in.A diagnosis out.
1Connect
Webhook endpoint
https://payhook.co/in/3f6c1d9b
StripePaddleLemon SqueezyPolarDodo Payments
forwards to acme.app/api/webhooks
Paste one URL
Point Stripe, Paddle, Lemon Squeezy, Polar or Dodo at your PayHook URL. Every event still reaches your app, byte for byte.
2Check
Incoming events
invoice.paidStripesigned200 · 84 ms
order.paidPolarwrong secret401 · 38 ms
transaction.completedPaddlesignedno answer in 10 s
Every event gets a verdict
PayHook checks each signature the way that provider signs it, and records what your endpoint answered and how long it took.
3Fix
Diagnosis
Your handler, not Stripe
invoice.subscription is empty on this invoice, so the handler throws before it answers.
Copy for CursorClaude Code
Read what broke, paste the fix
A plain-English diagnosis names the real cause. One click copies a fix prompt with the event inside, ready for Cursor or Claude Code.
After launch
Replay any event — re-signed with your secret so your verification still passes — optionally with an edited payloadSoon
payhook listen, straight to localhostSoon
MCP server, so your agent reads events itselfSoon
Alerts when a payment doesn't activateSoon
Providers
All five, one URL.Including the ones Stripe CLI doesn't cover.
Stripestripe-signatureHMAC-SHA256, 5-minute windowSupported at launch
Paddlepaddle-signatureHMAC-SHA256, 5-second windowSupported at launch
Lemon Squeezyx-signatureHMAC-SHA256, no timestampSupported at launch
Polarwebhook-signatureStandard Webhooks, both key formatsSupported at launch
Dodo Paymentswebhook-signatureStandard WebhooksSupported at launch
Pricing
Start free.Or lock in lifetime early.
Free
$0forever
Try PayHook on one project, with every signature check included.
PayHook is in early access: the signature-verification core is built and tested; the hosted app ships in 4–6 weeks. Pre-order now — full refund anytime, no questions asked: just email [email protected].
Everything in Pro, for life
AI diagnosis with a fair monthly limit
Early access before the public launch
Full refund anytime
Prices in USD. Lifetime includes a fair-use limit on AI diagnosis, with credits beyond it.
No. You paste your PayHook URL into the provider's webhook settings, and PayHook passes every event on to your endpoint with the original body and headers. Your handler keeps checking signatures exactly as it does today.
How is this different from Stripe CLI?
Stripe CLI is Stripe-only, terminal-only, and doesn't explain anything. PayHook covers five providers, works even when you have no localhost (Lovable, Bolt), and tells you why activation failed.
How is this different from Hookdeck or webhook.site?
They transport and display webhooks — great at it. PayHook is payment-specific: signature schemes per provider, expected event sequences, and activation diagnosis. We tell you what's wrong, not just what arrived.
Can PayHook break or delay my webhooks?
PayHook stores each event and answers the provider right away, then delivers it to your app with retries and shows every attempt. It is best effort with visible results, not guaranteed delivery with an SLA.
Can I replay an event? Won't my signature check reject it?
Replays are re-signed with your project's webhook secret using your provider's exact signature scheme and a fresh timestamp — so they pass the same verification your production code runs. Replayed events carry an X-PayHook-Replay header (with the original event id) so your handler can tell them apart.
I build with AI (Cursor / Claude Code / Lovable). Will this help me?
It's built for you. Every event comes with a plain-English explanation and a fix prompt you paste into your editor. An MCP server is coming so your agent can read events itself.
Do you see my customers' payment data?
Webhook events are stored for your debugging only — you can delete them anytime. The core is going open source, so you'll be able to self-host and keep everything on your own server.
What exactly does lifetime include?
Everything in Pro for one payment of $99, for as long as PayHook runs. AI diagnosis comes with a fair monthly limit, with credits beyond it. Only the first 100 buyers get it, then the offer closes for good.
Is this live today?
Not yet. The signature-verification core is built and mutation-tested. The hosted app ships in 4–6 weeks. You're pre-ordering early access — full refund anytime, just email [email protected].
Is PayHook open source?
The core opens at launch: event intake, the inspector, signature checks and the CLI. The hosted cloud and the AI diagnosis are the paid part.
Who's building this?
A solo fullstack developer with a fintech background, building in public — follow along on X.
Early access
Your next failed webhook,explained in one click.
Payments open once our merchant verification completes (days, not weeks). Leave your email — you'll get the early-bird link first, before the public.