Real-time updates with a Stripe webhook

You do not need this. sumwerk reads your Stripe account every hour, and “Sync now” on the Overview reads it at once. For a monthly board report, a weekly pipeline meeting or a daily look at the dashboard that is enough.

A webhook is for teams who act on the minute: an automation that should give the owner a task as soon as a customer schedules a cancellation, a Slack message when a payment fails, a dashboard on a wall screen. With a webhook, Stripe tells sumwerk that something changed, and the numbers follow within about a minute.

How it works, and why it is safe

• You create the webhook endpoint in your own Stripe dashboard. sumwerk never writes to your Stripe account, and the restricted key you connected stays read-only.
• Every message from Stripe carries a signature. sumwerk checks it with the endpoint’s signing secret and refuses everything else, including messages older than five minutes.
• sumwerk treats a message only as a signal. It does not take amounts or states from it: it reads the facts from Stripe’s API with your read-only key, exactly as the hourly sync does. A forged or replayed message can at most cause one extra sync.
• Several messages in a row (one checkout sends half a dozen) cause one sync, about half a minute after the first. The hourly sync keeps running, so a missed message costs at most an hour.
• Messages of the other mode (test events on a live connection) and of kinds that change no number are acknowledged and ignored.

Set-up

1. In sumwerk, open Account → Stripe and sync → Real-time updates and copy the endpoint URL. It looks like this, with a long random part that names your account:

   https://www.sumwerk.com/integrations/stripe/Zk3…/webhook
   

2. In Stripe, open Developers → Webhooks → Add destination. Choose “Your account”, paste the URL, and select these events:

   Group	Events
   Subscriptions	all customer.subscription.*
   Discounts	all customer.discount.*
   Schedules	all subscription_schedule.*
   Invoices	all invoice.*
   Credit notes	all credit_note.*
   Customers	customer.created, customer.updated, customer.deleted

   More events do no harm: sumwerk ignores what it does not need.

3. Stripe shows the endpoint’s signing secret (whsec_…). Paste it into the field in sumwerk and press Switch on. The secret is stored encrypted and never shown again.

From the next change in Stripe on, the section shows the last event received and how many arrived in the last 24 hours.

Switching it off

Press Switch off in sumwerk (the secret is forgotten, the hourly sync continues), then delete the endpoint in Stripe. If you only delete it in Stripe, nothing breaks: no more messages arrive, and sumwerk reads every hour as before. Disconnecting Stripe in sumwerk forgets the signing secret too.

Questions

Stripe shows failed deliveries. 400 means the signature did not match: the secret in sumwerk belongs to another endpoint, so paste the one of this endpoint again. 404 means the URL is not the one on your account page, or the webhook is switched off in sumwerk.

I sent a test event and nothing shows. A live connection ignores events from test mode (and the other way round), so the “last event” line does not move. Change something real, or wait for the next invoice.

Does this change any number? No. The same data is read either way; it only arrives sooner.