Respond to a Stripe Issuing real-time authorization webhook to approve or decline a virtual card transaction based on business logic

In-depth guide

Steps

1. Subscribe to the issuing_authorization.request webhook event in your Stripe webhook endpoint settings; Stripe sends this event synchronously and expects a response within a short timeout window (check current docs for the exact window, typically a few hundred milliseconds)
2. Verify the webhook signature using the Stripe-Signature header and your webhook signing secret before processing any authorization decision
3. Parse the Authorization object from the event payload; inspect amount, currency, merchant_data.category_code (MCC), merchant_data.name, cardholder.id, and card.spending_controls to make the approval decision
4. Respond to the webhook with HTTP 200 and a JSON body of {"approved": true} to approve or {"approved": false} to decline; any non-200 response or timeout results in Stripe applying the card's default spending_controls decision
5. Log the authorization event and your decision for audit purposes; subscribe to issuing_authorization.updated and issuing_authorization.created events for post-authorization tracking (captures and reversals)
6. Test authorization webhooks using Stripe's test mode and the testmode simulate authorization endpoint (POST /v1/test_helpers/issuing/authorizations/{id}/capture) to trigger synthetic authorization events without a physical card