Set up Stripe webhooks for charge.dispute.created and implement signature verification

In-depth guide

Steps

1. Create a webhook endpoint in the Stripe Dashboard or via POST /v1/webhook_endpoints with the url pointing to your HTTPS endpoint and events including charge.dispute.created (and optionally charge.dispute.updated, charge.dispute.closed).
2. Retrieve the webhook signing secret (whsec_...) from the Dashboard endpoint configuration; store it securely as an environment variable, never hardcode it.
3. In your endpoint handler, read the raw request body as bytes (do not parse JSON first) and extract the Stripe-Signature header containing t= (timestamp) and v1= (HMAC-SHA256 signature) components.
4. Verify the signature by constructing the signed payload as {timestamp}.{raw_body}, computing HMAC-SHA256 with your signing secret, and comparing the result against the v1 value in constant time to prevent timing attacks.
5. Reject requests where the timestamp is older than your tolerance window (Stripe recommends 300 seconds) to prevent replay attacks; return HTTP 400 for invalid signatures.
6. Return HTTP 200 immediately after signature verification before processing the event; use a background worker for dispute response logic to avoid webhook delivery timeouts.