Guides · Free check · $9 fix pack

Customers paid but didn't get access?
Check your Stripe webhook in 10 seconds.

Paste the webhook URL from your Stripe dashboard. We test whether Stripe can actually reach it, and whether a stranger could fake a payment. Built for apps made with Lovable, Bolt, Cursor, Replit and Claude Code.

Can Stripe reach it?

Redirects, 404s, login walls (Vercel protection, Supabase JWT, Cloudflare challenges) silently drop every real event.

Can someone fake a payment?

If your endpoint accepts an unsigned event, anyone with the URL can unlock your product for free.

Fix it with one prompt

Each issue comes with a copy-paste prompt for your AI builder. Re-check in one click.

Common problems, explained

Paid but no access · Signature verification failed · 307/308 redirects · Supabase / Lovable / Bolt · All guides

Where to find your webhook URL

Stripe Dashboard → Developers → Webhooks → click your endpoint → copy the URL at the top. Live mode is the one that matters.

What's free vs. $9

Free: score, every issue we find, and why it matters.
$9 one time, refundable for 14 days: the exact fix prompt for each issue for your stack, the 5-point hardening pack for the problems no outside scan can see (success-page grants, duplicate events, live/test secret mix-ups, missing events, silent failures), and 30 days of re-checks.

Is this safe to run?

We send at most 3 requests: two POSTs carrying a fake, non-actionable event type (webhookproof.probe, livemode false) and one GET. A correctly built endpoint rejects them. Nothing we send can create a charge or a customer in Stripe.