Checkout session expired

Fires once for each checkout session that passes its expiresAt without being completed. Expiry is checked every minute, so it can arrive a minute or so after expiresAt. A session whose checkout was archived is canceled instead and doesn't fire it. data.checkout is the checkout session, with status: expired.

Headers

X-Webhook-Signature
Type: string
required

t=<timestamp>,s=<signature>. t is when the delivery was signed, in Unix milliseconds; each attempt is signed afresh, so a retry has a new t. s is the Base64 (standard alphabet, padded) HMAC-SHA256 of the string <t>.<raw request body>, keyed with your signing secret: the whole whsec_… string as UTF-8. To verify, recompute it over the raw body exactly as received and compare in constant time, then reject a t too far from now (5 minutes is a good limit) so an old delivery can't be replayed. s can end in =, so split each part on its first = only.

Body

required

application/json

Every delivery's body.

- data
  Type:
  required
  
  The event's payload, under the key the event names.
  
  Properties: 1
- event
  enum
  const:
  billing-checkout-expired
  required
  
  A billing event you can receive. billing-invoice-paid, billing-invoice-posted, billing-invoice-refunded, billing-checkout-created, billing-checkout-completed, billing-checkout-expired, billing-payment-succeeded, billing-payment-failed, billing-credits-depleted, billing-overage-incurred and billing-credit-cap-reached; each is described in the Webhooks section.
  
  values
  billing-invoice-paid
  billing-invoice-posted
  billing-invoice-refunded
  billing-checkout-created
  billing-checkout-completed
  billing-checkout-expired
  billing-payment-succeeded
  billing-payment-failed
  billing-credits-depleted
  billing-overage-incurred
  billing-credit-cap-reached
- id
  Type: string
  required
  
  The delivery's ID (whd_…), the same on every retry of it: keep the IDs you've handled and ignore a delivery whose ID you've seen. A test delivery has an ID of its own.
- isTest
  Type: boolean
  required
  
  true for a delivery sent with Send a test delivery, whose data is placeholder; false otherwise.
- timestamp
  Type: stringFormat: date-time
  required
  
  When the event happened, and the delivery was first queued; the same on every retry.

Responses

200

Return any 2xx to acknowledge. Any other status, a redirect (redirects aren't followed), or no answer within 5 seconds is a failed attempt, recorded in the webhook's lastStatus. A failed delivery is retried 1 minute, 5 minutes, 30 minutes, 2 hours and then 12 hours after each failed attempt in turn (retries are sent by a sweep that runs every minute, so each can be up to a minute later), and dropped after the sixth failed attempt. A retry carries the same id and timestamp and goes to the webhook's current URL; a delivery whose webhook has since been switched off is dropped. Because of retries, an event can arrive more than once or after a later one: use id to ignore repeats. The response body is ignored.

postbilling-checkout-expired

{
  "id": "whd_Eh2Pz6Ks4Tc9Rw1Q",
  "event": "billing-checkout-expired",
  "timestamp": "2026-11-04T14:02:30.552Z",
  "isTest": false,
  "data": {
    "checkout": {
      "id": "cs_9Ma4uPddLHgyyKx9",
      "checkoutId": "chk_BwGV5N6u2t5CuL7I",
      "status": "expired",
      "customerId": "cus_Z8rT3nW6yP0aJc5E",
      "externalCustomerId": "northwind",
      "clientReferenceId": null,
      "selectedProduct": {
        "id": "prod_7Hk2LmQ9xR4tVb1N",
        "plan": {
          "id": "plan_4Fd8sK1mW9qZ2xCv",
          "name": "Growth",
          "externalId": "growth-monthly"
        }
      },
      "orderId": null,
      "invoiceId": null,
      "createdAt": "2026-11-03T14:02:11.000Z",
      "completedAt": null,
      "expiresAt": "2026-11-04T14:02:11.000Z"
    }
  }
}

No Body

Return any 2xx to acknowledge. Any other status, a redirect (redirects aren't followed), or no answer within 5 seconds is a failed attempt, recorded in the webhook's lastStatus. A failed delivery is retried 1 minute, 5 minutes, 30 minutes, 2 hours and then 12 hours after each failed attempt in turn (retries are sent by a sweep that runs every minute, so each can be up to a minute later), and dropped after the sixth failed attempt. A retry carries the same id and timestamp and goes to the webhook's current URL; a delivery whose webhook has since been switched off is dropped. Because of retries, an event can arrive more than once or after a later one: use id to ignore repeats. The response body is ignored.

Checkout session completed

Payment succeeded