// SECURITY
Can someone fake a payment on your app with an unverified webhook?
Updated 2026-08-11 · 5 min read
Yes. If your payment webhook accepts any request without verifying the provider’s signature, anyone can send a fake "payment succeeded" event and unlock paid features without paying. The fix is to verify the signature on every webhook using your provider’s signing secret before you trust the event.
What it is
A webhook is a message your payment provider (Stripe, Paystack) sends your server to say "this order was paid." Your app then grants access. If the endpoint does not check that the message really came from the provider, a stranger can send the same message themselves.
Why it matters to you
Free lifetime access for anyone who reads your API docs, plus fake orders polluting your data and revenue you never actually collected.
How to tell if your app has it
Look at your webhook handler. If it reads the event body and grants access without a signature-verification step (Stripe’s constructEvent with your signing secret, for example), it is unverified.
How it happens in AI-built apps
AI builders wire the happy path, receive event, mark as paid, because that demos correctly. Signature verification is an extra step the prompt never asked for, so it is skipped.
The fix
Verify every webhook signature before acting on it, and only grant access on verified, expected event types.
const event = stripe.webhooks.constructEvent(
rawBody, // the raw request body, not parsed JSON
req.headers['stripe-signature'],
process.env.STRIPE_WEBHOOK_SECRET,
); // throws if the signature is invalidAlso make the handler idempotent (ignore duplicate event ids) so a replayed event cannot double-grant.
Key takeaways
- An unverified webhook lets anyone fake a paid event.
- Verify the signature with your provider’s signing secret before trusting any event.
- Grant access only on verified, expected event types, and dedupe by event id.
Frequently asked
Isn’t the webhook URL secret enough?
No. URLs leak, and attackers guess predictable paths. Only a verified signature proves the event genuinely came from your payment provider.