메뉴
Use when testing Stripe payment webhooks locally, debugging webhook failures, Stripe CLI forward, replaying events, or webhook logs. Not for production deploy only or writing marketing copy.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | payment-webhook-testing |
| description | Use when testing Stripe payment webhooks locally, debugging webhook failures, Stripe CLI forward, replaying events, or webhook logs. Not for production deploy only or writing marketing copy. |
stripe login
stripe listen --forward-to http://127.0.0.1:54321/functions/v1/stripe-webhook
Copy the webhook signing secret CLI prints (whsec_...) into local STRIPE_WEBHOOK_SECRET (not production secret).
Trigger test events:
stripe trigger checkout.session.completed
stripe trigger customer.subscription.updated
stripe trigger invoice.payment_failed
For custom metadata (user_id), create sessions via API in test mode, then complete Checkout in browser, or use stripe trigger with fixtures where supported.
supabase functions serve stripe-webhook --env-file ./supabase/.env.local
Env file must include:
STRIPE_SECRET_KEY (sk_test_...)STRIPE_WEBHOOK_SECRET (from stripe listen)SUPABASE_URL, SUPABASE_SERVICE_ROLE_KEY| Check | How |
|---|---|
| Signature | Wrong secret → 400; correct → 200 |
| Idempotency | Send same event.id twice → second 200, no double DB row |
| DB write | Row in subscriptions / orders matches Stripe Dashboard |
| Live vs test | event.livemode matches environment |
event.id)| Symptom | Fix |
|---|---|
| Invalid signature | Raw body parsing; wrong whsec; body parsed as JSON before verify |
| 500 timeout | Return 200 after DB write; move email to async |
| User not linked | Missing client_reference_id / metadata.user_id on Checkout |
| Pro not unlocked | Client gating before webhook; add polling or Realtime on subscriptions |
4242 4242 4242 4242success_url without firing webhook.Use when reviewing or fixing accessibility: keyboard navigation, focus order, labels, color contrast, screen reader support, or ARIA attributes. Not for SEO-only or performance-only audits.
Use when adding product analytics (PostHog, GA4, Plausible), event tracking, funnels, or conversion measurement. Not for server logs only or A/B infra unless events are part of the task.
Use when standardizing API and edge function errors: HTTP status codes, error JSON shape, logging, or mapping Supabase/Stripe errors to client responses. Not for UI toast copy only or form field validation messages.
Use when recording audit trails: who changed what, admin action logs, compliance history, or append-only event tables. Not for product analytics (use analytics-events) or debug console logs only.
Use when scheduling background work: cron jobs, digest emails, cleanup tasks, pg_cron, Supabase scheduled edge functions, or job queues. Not for synchronous user-facing API in the request path.
Use when adding dark mode, theme toggle, system theme support, or fixing hardcoded colors that break in dark mode. Not for design-token migration unrelated to dark mode.