# Stripe webhook trigger

> Run a workflow on Stripe events: payments, charges, customers, invoices, and checkouts, with signature verification.

Source: https://cotera.co/docs/reference/webhooks/stripe

---

Run a workflow on Stripe events — a payment succeeds, a charge is refunded, an invoice is paid, a checkout completes. The Stripe event becomes the workflow's input.

For behavior shared by every provider (the delivery URL, testing), see the [webhook triggers reference](https://cotera.co/docs/reference/webhooks.md).

## Prerequisites

Stripe webhooks are **auto-registered**: Cotera creates the webhook endpoint for you over Stripe's API, using a connected Stripe API key. Without one, install fails with `stripe_credentials_missing`.

## Setup

1. Add a **From an app** trigger and pick **Stripe**.
2. Choose the event (see below).
3. Save. Cotera creates a Stripe webhook endpoint enabled for that event, pointed at the trigger's unique URL.

Deleting the trigger removes the webhook endpoint from Stripe.

## Events

The event key is the Stripe event `type`.

| Event key                    | Fires when                              |
| ---------------------------- | --------------------------------------- |
| `payment_intent.succeeded`   | A payment intent completes successfully |
| `charge.succeeded`           | A charge is successful                  |
| `charge.refunded`            | A charge is refunded                    |
| `customer.created`           | A customer is created                   |
| `invoice.paid`               | An invoice is paid                      |
| `checkout.session.completed` | A Checkout session completes            |

## Payload

The Stripe Event envelope is passed through as the workflow input; the affected resource is at `data.object`. A `payment_intent.succeeded` delivery looks like:

```json
{
  "id": "evt_1EXAMPLE",
  "object": "event",
  "api_version": "2024-06-20",
  "type": "payment_intent.succeeded",
  "created": 1689415800,
  "data": {
    "object": {
      "id": "pi_3EXAMPLE",
      "object": "payment_intent",
      "amount": 1999,
      "currency": "usd",
      "status": "succeeded",
      "customer": "cus_EXAMPLE"
    }
  }
}
```

| Field         | Description                                                                                    |
| ------------- | ---------------------------------------------------------------------------------------------- |
| `id`          | The Stripe event id, used to deduplicate retries.                                              |
| `type`        | The event type — matches the trigger's selected event.                                         |
| `created`     | When the event happened, as a Unix timestamp.                                                  |
| `data.object` | The affected Stripe object — a payment intent, charge, customer, invoice, or checkout session. |

## Signature verification

Stripe signs each delivery with the `Stripe-Signature` header in the form `t=<timestamp>,v1=<hex>` — an HMAC-SHA256, in hexadecimal, over `<timestamp>.<raw-body>`. The signing secret is generated by Stripe when the endpoint is created, so there's no per-trigger secret for you to manage. Cotera verifies it on every delivery and rejects anything that fails.