---
title: "Payment Webhooks Create"
method: POST
path: "/payment/webhooks/"
tags: ["billing"]
---

# Payment Webhooks Create

`POST /payment/webhooks/`

Handle Stripe webhook events.

Signature enforcement is **opt-in** via ``settings.STRIPE_WEBHOOK_SECRET``
so we can roll the code out as a no-op and flip enforcement on
later by setting the secret in ASM + reloading the server.

- Strict mode (secret set): the ``Stripe-Signature`` HMAC is
  verified against the configured secret. Missing header, bad
  signature, or malformed payload all reject with 400 before any
  handler runs. This closes the unauthenticated-credit-injection
  vector.
- Lenient mode (secret unset/empty): bit-for-bit identical to
  the pre-fix behavior (``stripe.Event.construct_from(request.data,
  stripe.api_key)``). Logs a warning + tags the dogfood span with
  ``enforcement_mode=lenient`` so traces make the vulnerability
  visible. This is the deploy-day default.

Dogfood tracing: every request tags
``stripe.webhook.enforcement_mode`` (strict|lenient) and every
failure branch tags ``stripe.webhook.failure_reason`` so incident
responders can triage in the trace UI without code-diving.

## Headers

- `Authorization` string, required

## Response `200`

No response body

- BillingPaymentWebhooksCreateResponse200 — Empty response body

---

[API](https://skmtc.net/keywordsai/apis/api-reference.md) · [All operations](https://skmtc.net/keywordsai/apis/api-reference/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/keywordsai/api-reference/versions/c26d550029f8/schema)