Checkout session completed

Fires when a checkout session completes: the buyer paid on Stripe Checkout or, without Stripe, started the order, and the order is now active. Once the buyer has paid, the order is always activated: whether another running order prices one of its events was checked when the Stripe Checkout session opened. data.checkout is the checkout session with status: completed, its orderId, completedAt and, once raised, the order's first invoiceId.

Headers

X-Webhook-Signature
Type: string
required

t=<timestamp>,s=<signature>. t is when the delivery was signed, in Unix milliseconds; each attempt is signed afresh, so a retry has a new t. s is the Base64 (standard alphabet, padded) HMAC-SHA256 of the string <t>.<raw request body>, keyed with your signing secret: the whole whsec_… string as UTF-8. To verify, recompute it over the raw body exactly as received and compare in constant time, then reject a t too far from now (5 minutes is a good limit) so an old delivery can't be replayed. s can end in =, so split each part on its first = only.

Body

required

application/json

Every delivery's body.

- data
  Type:
  required
  
  The event's payload, under the key the event names.
  
  Properties: 1
- event
  enum
  const:
  billing-checkout-completed
  required
  
  A billing event you can receive. billing-invoice-paid, billing-invoice-posted, billing-invoice-refunded, billing-checkout-created, billing-checkout-completed, billing-checkout-expired, billing-payment-succeeded, billing-payment-failed, billing-credits-depleted, billing-overage-incurred and billing-credit-cap-reached; each is described in the Webhooks section.
  
  values
  billing-invoice-paid
  billing-invoice-posted
  billing-invoice-refunded
  billing-checkout-created
  billing-checkout-completed
  billing-checkout-expired
  billing-payment-succeeded
  billing-payment-failed
  billing-credits-depleted
  billing-overage-incurred
  billing-credit-cap-reached
- id
  Type: string
  required
  
  The delivery's ID (whd_…), the same on every retry of it: keep the IDs you've handled and ignore a delivery whose ID you've seen. A test delivery has an ID of its own.
- isTest
  Type: boolean
  required
  
  true for a delivery sent with Send a test delivery, whose data is placeholder; false otherwise.
- timestamp
  Type: stringFormat: date-time
  required
  
  When the event happened, and the delivery was first queued; the same on every retry.

Responses

200

Return any 2xx to acknowledge. Any other status, a redirect (redirects aren't followed), or no answer within 5 seconds is a failed attempt, recorded in the webhook's lastStatus. A failed delivery is retried 1 minute, 5 minutes, 30 minutes, 2 hours and then 12 hours after each failed attempt in turn (retries are sent by a sweep that runs every minute, so each can be up to a minute later), and dropped after the sixth failed attempt. A retry carries the same id and timestamp and goes to the webhook's current URL; a delivery whose webhook has since been switched off is dropped. Because of retries, an event can arrive more than once or after a later one: use id to ignore repeats. The response body is ignored.

postbilling-checkout-completed

{
  "id": "whd_Df8Jm3Wq7Nb2Vy5L",
  "event": "billing-checkout-completed",
  "timestamp": "2026-11-03T14:06:48.031Z",
  "isTest": false,
  "data": {
    "checkout": {
      "id": "cs_9Ma4uPddLHgyyKx9",
      "checkoutId": "chk_BwGV5N6u2t5CuL7I",
      "status": "completed",
      "customerId": "cus_Z8rT3nW6yP0aJc5E",
      "externalCustomerId": "northwind",
      "clientReferenceId": null,
      "selectedProduct": {
        "id": "prod_7Hk2LmQ9xR4tVb1N",
        "plan": {
          "id": "plan_4Fd8sK1mW9qZ2xCv",
          "name": "Growth",
          "externalId": "growth-monthly"
        }
      },
      "orderId": "ord_2Lp9Xc4Vb7Nm1Qz6",
      "invoiceId": "inv_dmdae6RsVMaW7T5I",
      "createdAt": "2026-11-03T14:02:11.000Z",
      "completedAt": "2026-11-03T14:06:47.000Z",
      "expiresAt": "2026-11-04T14:02:11.000Z"
    }
  }
}

No Body

Return any 2xx to acknowledge. Any other status, a redirect (redirects aren't followed), or no answer within 5 seconds is a failed attempt, recorded in the webhook's lastStatus. A failed delivery is retried 1 minute, 5 minutes, 30 minutes, 2 hours and then 12 hours after each failed attempt in turn (retries are sent by a sweep that runs every minute, so each can be up to a minute later), and dropped after the sixth failed attempt. A retry carries the same id and timestamp and goes to the webhook's current URL; a delivery whose webhook has since been switched off is dropped. Because of retries, an event can arrive more than once or after a later one: use id to ignore repeats. The response body is ignored.

Checkout session created

Checkout session expired