Fix Stripe webhooks rejected by Supabase auth
First customer paid, but the app never upgraded him · Blog (GhostNote) · ghostnoteai.dev · date not shown
On launch day a Supabase function rejected Stripe's webhook because it required a user login token, so a paying customer stayed on the free tier.
The honest numbers
- Says the first payment came 4 hours after launch
- Says the subscription was $9.99
- Says about 30 minutes reading logs for a one-line fix
As stated by the source. Not independently verified.
Lesson
Run one real low-value payment through production before launch, and verify the Stripe signature instead of requiring a user token on webhooks.
Fix prompt
Copy this into your own AI tool (Cursor, Lovable, Claude Code, Bolt…). It's general guidance written by us. Review what the AI suggests before applying it.
I'm a beginner with a Supabase app that takes payments with Stripe (or a similar provider). Please audit the payment flow. 1) Find the webhook endpoint and check that it verifies the provider's signature using the raw request body, and isn't blocked by my own auth (e.g. Supabase verify_jwt on the function). 2) Check that it handles failed payments, refunds, cancellations and the same event arriving twice (idempotency). 3) Make sure only the server/webhook can change a user's plan or credits, never the browser. 4) List problems with file names and fixes, then give me a test checklist using test-mode events and one small real payment. Don't change anything until I've approved your plan. Never ask me to paste API keys, passwords or .env contents; tell me where to check them myself.
Source: Blog (GhostNote) ↗