Invoices mark themselves paid

A thin route that hands the raw body and signature to the payments adapter for verification and interpretation, then records the payment. Verification tries every configured signing secret because the payload cannot be parsed for the account until after verification. Refunds and disputes are acknowledged and logged rather than acted on.

Also called: payment confirmation · invoice paid automatically · checkout webhook

1. 1The raw body is read (never parsed first, because the signature is over the raw bytes).
2. 2The adapter verifies against each candidate signing secret: environment first, then every account's stored secret.
3. 3Completed sessions are gated on payment_status being paid, so bank-debit methods that complete before funds clear do not mark an invoice paid.
4. 4The invoice, account and amount are read from the session metadata and recorded idempotently.
5. 5A database failure returns 500 so the provider retries; the reconcile sweep is the ultimate backstop.

• ◆Invoices had to be marked paid by hand.
• ◆Bank-debit payments were marked paid before funds cleared.
• ◆The account could not be identified before the signature was verified.