WEBVTT

00:00.096 --> 00:02.259
Customer paid, no access,

00:02.259 --> 00:04.975
and your Stripe delivery log shows 401.

00:04.975 --> 00:05.901
If your webhook is a

00:05.901 --> 00:07.488
Supabase Edge Function,

00:07.488 --> 00:11.220
the likely cause is JWT verification.

00:11.316 --> 00:14.393
Edge Functions check for a Supabase JWT

00:14.393 --> 00:15.438
by default.

00:15.438 --> 00:16.857
Stripe can't send one.

00:16.857 --> 00:18.912
So Stripe gets a 401,

00:18.912 --> 00:21.096
and your function code never runs.

00:21.204 --> 00:22.622
You can see this from the outside

00:22.622 --> 00:25.483
with the free check at webhookproof.com.

00:25.483 --> 00:26.949
Paste your function URL,

00:26.949 --> 00:28.067
confirm you own it,

00:28.067 --> 00:29.460
and run the check.

00:29.556 --> 00:31.707
A healthy endpoint, like this one,

00:31.707 --> 00:34.704
rejects the unsigned test events itself.

00:34.800 --> 00:36.867
A function behind the JWT wall

00:36.867 --> 00:38.514
answers 401,

00:38.514 --> 00:40.136
Missing authorization header,

00:40.136 --> 00:41.663
and the check flags a login wall

00:41.663 --> 00:43.764
that Stripe can't get past.

00:43.872 --> 00:45.735
The fix, from Supabase's own

00:45.735 --> 00:47.417
Stripe webhook example:

00:47.417 --> 00:49.869
turn off JWT verification

00:49.869 --> 00:51.252
for that one function.

00:51.252 --> 00:53.018
In the Supabase config file,

00:53.018 --> 00:55.410
set verify JWT to false

00:55.410 --> 00:56.528
for that function.

00:56.528 --> 01:00.504
Or deploy with the no-verify-JWT flag.

01:00.612 --> 01:02.126
That makes the function public,

01:02.126 --> 01:04.530
so verify the Stripe signature instead.

01:04.530 --> 01:06.441
Read the raw body as text,

01:06.441 --> 01:08.232
and call construct event async

01:08.232 --> 01:09.999
with a Web Crypto provider.

01:09.999 --> 01:11.092
The synchronous version

01:11.092 --> 01:12.804
doesn't work in Deno.

01:12.900 --> 01:14.474
Then resend the failed events

01:14.474 --> 01:16.085
from the Stripe Dashboard.

01:16.085 --> 01:18.236
Free check at webhookproof.com.

01:18.236 --> 01:21.144
Not affiliated with Stripe or Supabase.