When a secret key is saved without a webhook secret, the platform uses that key to create a webhook endpoint on the two payment events it needs, stores the returned signing secret encrypted, and reports the outcome to the UI as auto_created, already, manual or needs_manual with a plain-language message.
Also called: signing secret · webhook endpoint · do I have to configure Stripe · no dashboard fiddling
- 1Admin saves a Stripe secret key with no webhook secret pasted.
- 2If a secret is already stored, nothing is created.
- 3With a public https app URL, an endpoint is created for checkout.session.completed and checkout.session.async_payment_succeeded.
- 4The returned signing secret is encrypted and stored.
- 5On a local or non-public URL the state is needs_manual with a message explaining payments still update via the return redirect.
The comment states the goal plainly: 'AUTO-PROVISION the webhook so the tenant never has to create one or hunt for a signing secret.' The local-development case is handled with a message that avoids alarming the user: 'Connected — you're all set. Paid invoices update automatically. (The webhook backup can't auto-create on localhost, but you don't need it; it auto-creates in production.)'
- Builders had to create a webhook endpoint by hand and copy a secret.
- A missing webhook silently broke automatic invoice-paid updates.
See it on your own jobs
Twenty minutes, your numbers, no slide deck. We’ll build one of your real buildings in front of you and send you the estimate link at the end — yours to keep either way.
or keep browsing features →