Setting up the Stripe Webhook

The Stripe webhook is how Stripe tells your site what happened after a payment: a new subscription, a renewal, a cancellation, or a product you changed in Stripe. Without it, WP User Manager never hears about renewals or cancellations, so members can keep access after they stop paying. Set it up once for test mode and once for live mode.

1. Copy your webhook URL

In WordPress, go to Users > Settings > Stripe. The webhook URL is shown under the Webhook Signing Secret setting for the mode you’re in (test or live). It looks like this:

https://example.com/wp-json/wpum/v1/stripe

Your site needs to be reachable on the internet over HTTPS for Stripe to send to it. For a local development site, see testing locally below.

2. Create the webhook in Stripe

1. In your Stripe dashboard, open Workbench and go to the Webhooks tab. Make sure you’re in the same mode (test or live) as WP User Manager.
2. Click Create an event destination.
3. Choose Your account.
4. For the payload format, choose Snapshot. Stripe recommends Thin, but WP User Manager reads full (snapshot) events, so a thin destination won’t work.
5. Select these events:
6. checkout.session.completed
7. checkout.session.async_payment_succeeded
8. customer.subscription.created
9. customer.subscription.updated
10. customer.subscription.deleted
11. invoice.payment_succeeded
12. product.created
13. product.updated
14. product.deleted

Selecting all events also works, but Stripe recommends sending only the ones you use.
6. Click Continue, choose Webhook endpoint as the destination type, and click Continue again.
7. Paste your webhook URL into Endpoint URL and save.

3. Add the signing secret to WP User Manager

1. On the new webhook’s page in Stripe, find the signing secret (it starts with whsec_) and click to reveal it.
2. Copy it into the Webhook Signing Secret setting for the same mode in Users > Settings > Stripe, and click Save Changes.

WP User Manager uses the secret to check that every message really came from Stripe. Test and live mode each have their own webhook and their own secret, so repeat these steps when you switch to live.

4. Check it works

Register on your site as a test member with one of Stripe’s test cards. Then, in Stripe, open the webhook and look at its Event deliveries tab: the events should show as Delivered. If they show as failed:

• Signature errors (400): the signing secret in WordPress doesn’t match this webhook, or it’s from the other mode. Copy it again.
• Not found (404) or redirect (3xx): the URL is wrong, or your site redirects it (for example from http to https, or to www). Use the exact URL from step 1.
• Unable to connect or timed out: your site isn’t reachable from the internet, or a security plugin or firewall is blocking Stripe. Allow requests to the webhook URL.

You can resend a failed event from Stripe once it’s fixed.

Testing locally

Stripe can’t reach a site on your own computer. Either use a tunnel such as ngrok to give it a public HTTPS address, or use the Stripe CLI to forward events to it:

stripe listen --forward-to https://yoursite.test/wp-json/wpum/v1/stripe

The command prints a signing secret starting with whsec_. Paste that into the test mode Webhook Signing Secret while you test.

Related

• Collecting payment on registration
• Recurring subscriptions
• How to accept recurring payments with Stripe in WordPress

Get Started with the Best WordPress Membership Plugin Today

Connect, Manage and Build your Membership Site

Explore Features Get Started