Guides · Free check · $9 fix pack

Lemon Squeezy webhook not firing?
Check your endpoint in 10 seconds.

Paste the webhook URL you saved in Lemon Squeezy. We test whether Lemon Squeezy can actually reach it, and whether a stranger could fake an order. Built for apps made with Lovable, Bolt, Cursor, Replit and Claude Code.

Can Lemon Squeezy reach it?

Redirects, 404s, login walls (Vercel protection, Supabase JWT, auth middleware) and Cloudflare bot blocks drop every real event. Lemon Squeezy only counts an HTTP 200 as delivered and retries three more times before giving up.

Can someone fake an order?

We send one unsigned request and one with a forged signature. The check checks X-Signature (hex HMAC-SHA256 of the raw body). If either gets a 2xx, anyone with the URL may be able to unlock your product.

Fix it with one prompt

Each issue comes with a copy-paste Lemon Squeezy prompt for your stack. Re-check in one click.

Lemon Squeezy webhook guides

Lemon Squeezy webhook signature invalid? Fix X-Signature in 5 steps

Where to find your webhook URL

Lemon Squeezy dashboard → Settings → Webhooks → copy the Callback URL. Test mode and live mode have separate webhooks; check the one your customers hit.

What's free vs. $9

Free: score, every issue we find, and why it matters.
$9 one time, refundable for 14 days: the exact Lemon Squeezy fix prompt for each issue for your stack, the 5-point Lemon Squeezy hardening pack (raw-body hashing (the escaped-slash trap), exact-200 responses, thank-you-page grants, duplicates, test/live mode mix-ups), and 30 days of re-checks.

Is this safe to run?

We send at most 3 requests: two POSTs with a made-up event name (webhookproof_probe / webhookproof.probe), one without a signature and one with an all-zero signature, plus one GET. A correctly built endpoint rejects both POSTs. Nothing we send can create an order, a charge or a customer in Lemon Squeezy.

Also checks Stripe · Paddle · Polar. WebhookProof is not affiliated with Lemon Squeezy.