Many apps built with Lovable or Bolt run their backend on Supabase. Two Supabase-specific settings break Stripe webhooks.
By default, Edge Functions expect a Supabase JWT. Stripe can't send one. Supabase's config docs show disabling it for the webhook function in supabase/config.toml:
[functions.stripe-webhook] verify_jwt = false
(Supabase docs: function configuration). Supabase warns this lets anyone call the function, which is why the next step is not optional.
Supabase's Stripe example reads the raw body with await req.text() and verifies with stripe.webhooks.constructEventAsync(body, signature, secret, undefined, cryptoProvider), where cryptoProvider = Stripe.createSubtleCryptoProvider() (Supabase docs: Stripe webhooks). Using the sync constructEvent or parsing JSON first fails.
Store the endpoint's signing secret as a function secret. Test and live endpoints have different secrets (Stripe docs), so update it when you go live.
In my Supabase Edge Function for Stripe webhooks: 1) set verify_jwt = false for this function only; 2) read the body with await req.text(); 3) verify with stripe.webhooks.constructEventAsync using Stripe.createSubtleCryptoProvider(); 4) return 400 if verification fails; 5) handle checkout.session.completed and checkout.session.async_payment_succeeded by granting access idempotently (skip if this session was already fulfilled); 6) return 200 quickly.
Paste your webhook URL. WebhookProof sends 3 harmless test requests and tells you whether Stripe can reach it and whether it rejects unsigned events.
Run the free checkEdge Functions verify a Supabase JWT by default and Stripe cannot send one. Set verify_jwt = false for that function and rely on Stripe signature verification instead.
Supabase's example uses stripe.webhooks.constructEventAsync with Stripe.createSubtleCryptoProvider() and the raw body from req.text().
Only if the function verifies the Stripe signature and rejects anything that fails. Otherwise anyone can call it.
Stripe webhook not working? Check these 7 things in order · A customer paid but didn't get access. What went wrong? · Stripe webhook signature verification failed · Stripe webhook getting a 307 or 308 redirect
Last reviewed 2026-10-18. WebhookProof is an independent tool, not affiliated with Stripe, Inc. Quotes are from the linked documentation.