Stripe Integration Checklist

Make the webhook the source of truth

• Trigger fulfillment only from a verified payment_intent.succeeded webhookFulfilling on the redirect misses orders when tabs close and ships fake ones when someone visits the success URL.
• Verify the Stripe signature against the raw request bodyAn unverified endpoint accepts forged events, and parsing the body first breaks the signature check.
• Acknowledge webhooks fast and do slow work afterwardA slow response invites timeouts and redelivery, which multiplies the duplicates you must handle.
• Dedupe on the event id and key fulfillment on the paymentStripe sends the same event more than once by design, so without this an order can be fulfilled twice.