Stripe

Run a workflow on Stripe events — a payment succeeds, a charge is refunded, an invoice is paid, a checkout completes. The Stripe event becomes the workflow's input.

For behavior shared by every provider (the delivery URL, testing), see the webhook triggers reference.

Prerequisites

Stripe webhooks are auto-registered: Cotera creates the webhook endpoint for you over Stripe's API, using a connected Stripe API key. Without one, install fails with stripe_credentials_missing.

Setup

Add a From an app trigger and pick Stripe.
Choose the event (see below).
Save. Cotera creates a Stripe webhook endpoint enabled for that event, pointed at the trigger's unique URL.

Deleting the trigger removes the webhook endpoint from Stripe.

Events

The event key is the Stripe event type.

Event key	Fires when
`payment_intent.succeeded`	A payment intent completes successfully
`charge.succeeded`	A charge is successful
`charge.refunded`	A charge is refunded
`customer.created`	A customer is created
`invoice.paid`	An invoice is paid
`checkout.session.completed`	A Checkout session completes

Payload

The Stripe Event envelope is passed through as the workflow input; the affected resource is at data.object. A payment_intent.succeeded delivery looks like:

{
  "id": "evt_1EXAMPLE",
  "object": "event",
  "api_version": "2024-06-20",
  "type": "payment_intent.succeeded",
  "created": 1689415800,
  "data": {
    "object": {
      "id": "pi_3EXAMPLE",
      "object": "payment_intent",
      "amount": 1999,
      "currency": "usd",
      "status": "succeeded",
      "customer": "cus_EXAMPLE"
    }
  }
}

Field	Description
`id`	The Stripe event id, used to deduplicate retries.
`type`	The event type — matches the trigger's selected event.
`created`	When the event happened, as a Unix timestamp.
`data.object`	The affected Stripe object — a payment intent, charge, customer, invoice, or checkout session.

Signature verification

Stripe signs each delivery with the Stripe-Signature header in the form t=<timestamp>,v1=<hex> — an HMAC-SHA256, in hexadecimal, over <timestamp>.<raw-body>. The signing secret is generated by Stripe when the endpoint is created, so there's no per-trigger secret for you to manage. Cotera verifies it on every delivery and rejects anything that fails.