Emithook Docs

Appearance

Receive a Stripe webhook ​

A complete inbound walkthrough: take Stripe events, verify the timestamped Stripe-Signature, and fan them out to your API and a queue — losing nothing if your service is down.

What you'll build ​

Stripe  ──▶  <ingest-domain>/stripe-live/events  ──▶  ├─ HTTPS  https://api.acme.in/billing
        (acked + buffered <100ms; signature verified in processing)  └─ SQS    acme-billing-q

1. Create the endpoint ​

Use the Stripe preset — it configures the timestamped HMAC-SHA256 check Stripe signs with and the fast 2xx ack Stripe expects.

bash
curl -X POST https://api.emithook.com/v1/endpoints \
  -H "Authorization: Bearer $EK_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://wh.emhk.in/acme/stripe-live/events",
    "preset": "stripe",
    "destinations": ["dst_acme_https", "dst_acme_sqs"]
  }'
json
// → 201 Created
{
  "id": "ep_01JX9...",
  "url": "https://<ingest-domain>/stripe-live/events",
  "verification": "stripe",
  "status": "active"
}

TIP

The URL is live immediately on the shared ingest domain (<ingest-domain>, config-driven) — no DNS. Add it in the Stripe dashboard under Developers → Webhooks → Add endpoint.

2. Add the verification secret ​

Paste the signing secret Stripe shows you when you add the endpoint (it starts with whsec_) so Emithook can verify the Stripe-Signature header in the processing plane:

bash
curl -X PUT https://api.emithook.com/v1/endpoints/ep_01JX9.../secret \
  -H "Authorization: Bearer $EK_KEY" \
  -d '{ "secret": "whsec_..." }'

Stripe signs <t>.<raw-body> with HMAC-SHA256 (hex) and sends it as Stripe-Signature: t=<unix>,v1=<hex>. Emithook recomputes the signature over the raw body, checks any v1 matches (so key rotation keeps working), and enforces a 5-minute replay window on t. The edge accepts and durably buffers every request in <100 ms (never dropped); verification then runs in the processing plane. A request that fails verification is quarantined — durable and inspectable, but never delivered (not a 401 at the edge, never silently dropped).

3. What an incoming request looks like ​

http
POST /stripe-live/events HTTP/1.1
Host: <ingest-domain>
Stripe-Signature: t=1720099471,v1=5257a869e7...
Content-Type: application/json

{ "id": "evt_1PX...", "type": "payment_intent.succeeded", "data": { "object": { "amount": 4999 } } }
http
HTTP/1.1 200 OK
{ "received": true }

Emithook acks in under 100 ms, then fans the event out to both destinations independently — each signed, retried, and logged on its own.

4. Confirm delivery ​

bash
emithook logs tail --endpoint /stripe-live/events
12:04:31  evt_01JX… payment_intent.succeeded → dst_acme_https   200  142ms  ✓
12:04:31  evt_01JX… payment_intent.succeeded → dst_acme_sqs      enqueued    ✓

If api.acme.in is down, Emithook retries with backoff and parks events behind the circuit breaker — when it recovers, they drain automatically. Nothing is lost.

5. Replay if needed ​

bash
# replay everything that dead-lettered for this endpoint
emithook replay --dlq --endpoint /stripe-live/events

See also ​

Emithook · a Finnoto product

© 2026 Emithook