Configure a webhook endpoint to receive issuing_authorization.request events and ensure it responds within 2 seconds
Verify the Stripe-Signature header using your webhook signing secret before processing
Inspect the authorization object fields: merchant_data.category, pending_request.amount, cardholder, and metadata to apply your approval logic
Return a JSON response with the Boolean field "approved" set to true or false — this is the exact field name Stripe requires
Optionally include "amount" in the response body to approve a lesser amount than requested (partial approval)
If your endpoint does not respond within 2 seconds, Stripe applies the default authorization behavior configured on the card; log timeouts for review
Known gotchas
The response field is "approved" (Boolean) — NOT "approve"; returning the wrong field name causes Stripe to fall back to the card's default behavior, which may silently approve or decline
Your endpoint must respond within 2 seconds wall-clock time — include no heavy computation or synchronous database writes in the hot path
Always verify the webhook signature; unauthenticated authorization endpoints are a critical security risk
Give your agent this knowledge — and 15,800+ more routes
One MCP install gives any agent live access to the full route map across 5,800+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?