Continuing on from my last post Sell products with Stripe let's first setup a webhook on stripe by going to Developers -> Webhooks https://dashboard.stripe.com/webhooks
Add a new webhook, provide a URL for the webhook to go to such as https://domain.com/webhooks/stripe
select the events to listen to since I'm dealing with the hosted checkout for one-off products I want the checkout session.checkout.completed event.
Once created click into the webhook and press reveal under signing secret to reveal the webhook API key. Add this key to your .env file
STRIPE_WEBHOOK_SECRET=
Next open App/Http/Middleware/VerifyCsrfToken.php to whitelist an endpoint to allow Stripe to send POST requests in.
class VerifyCsrfToken extends Middleware
{
/**
* The URIs that should be excluded from CSRF verification.
*
* @var array
*/
protected $except = [
'webhooks/stripe',
];
}
Create a route
Route::post('webhooks/stripe', [WebhooksController::class, 'collect']);
In the controller create a method, set the stripe API key, secret and collect POST data using php//input
Then in a try-catch verify the webhook API key with Stripe.
public function collect()
{
Stripe::setApiKey(config('services.stripe.secret'));
$secret = config('services.stripe.webhook');
$payload = file_get_contents("php://input");
$sig_header = $_SERVER["HTTP_STRIPE_SIGNATURE"];
$event = null;
try {
$event = Webhook::constructEvent($payload, $sig_header, $secret);
} catch (\UnexpectedValueException $e) {
// Invalid payload
http_response_code(400);
return true;
} catch (SignatureVerification $e) {
// Invalid signature
http_response_code(400); // PHP 5.4 or greater
return true;
}
// Handle the checkout.session.completed event
if ($event->type === 'checkout.session.completed') {
$this->handle_checkout_session($event);
}
http_response_code(200);
}
Finally checking the $event->type matches the event checkout.session.completed all another method and pass in the event.
Inside the event drill down to the metadata which will contain any data sent to stripe, open you will put a user id and product in so you can process orders.
public function handle_checkout_session($eventData)
{
$meta = $eventData->data->object->metadata;
if (isset($meta->user_id)) {
$purchase = Purchase::create([
'user_id' => $meta->user_id,
'product_id' => $meta->product_id,
'data' => json_encode($eventData),
]);
Mail::
to($purchase->user->email)
->send(new PurchasedProduct($purchase));
}
}
In this case, I create a transaction log and send an email to the customer.
The important thing is in the collect method to respond to Stripe as quick as possible by sending an HTTP status code and after sending a response process the data.
