Laravel Stripe Integration

Authentication and data flow

Inbound: Stripe signs webhooks. Verify the signature with the endpoint secret for that environment. Do not share test and live secrets. Process the event on a queue; return 2xx quickly.

Outbound: API keys belong in env, not in Git. Prefer restricted keys where the product allows. The Laravel app is not the source of truth for “has money moved” — Stripe is. Your tables should store your entitlement state derived from events, not a guess from the last browser request.

Common failure modes

• Webhook endpoint still pointing at a developer’s ngrok.
• Duplicate events creating duplicate entitlements because the handler is not idempotent on event.id.
• checkout.session.completed handled but invoice.paid / subscription deletion ignored.
• Customer created in Stripe with a personal email, then the business cannot access the account.

Example pattern (characterisation, not a copy-paste product)

// Verify, then queue. Never do entitlement work in the HTTP request.
Route::post('/stripe/webhook', StripeWebhookController::class);

The controller’s only job is verify + persist payload + dispatch job. The job checks it has not processed evt_... before.

Stripe’s own webhook docs: stripe.com/docs/webhooks.