Stripe App & Multi-Stack Webhook Guard Reference

Before dropping the middleware snippet into your app, map these three credentials from your Merchant Console (/dashboard), 2-Min Quickstart (/docs/onboarding), or test ephemerally in /tools/stripe-basil-auditor:

// app/api/webhooks/revclamp/route.ts -- Next.js App Router (TypeScript Edge/Node)
import crypto from "node:crypto";

export async function POST(req: Request) {
  const rawBody = await req.text();
  const payload = JSON.parse(rawBody); // payload.event: "revclamp.entitlement.revoke" | "revclamp.entitlement.restore"
  const [, t = "", v1 = ""] = (req.headers.get("x-revclamp-signature") || "").match(/^t=(\d+),v1=([0-9a-f]{64})$/) || [];
  if (!t || !v1 || Math.abs(Math.floor(Date.now() / 1000) - Number(t)) > 300) return Response.json({ ok: false, error: "INVALID_SIGNATURE" }, { status: 401 });
  if (payload.event !== "revclamp.entitlement.revoke" && payload.event !== "revclamp.entitlement.restore") return Response.json({ ok: false, error: "UNSUPPORTED_EVENT" }, { status: 400 });
  const scope = payload.event === "revclamp.entitlement.restore" ? "revclamp_restore_scope" : "revclamp_revoke_scope";
  if (process.env.REVCLAMP_TENANT_ID && payload.tenant_id !== process.env.REVCLAMP_TENANT_ID) return Response.json({ ok: false, error: "TENANT_MISMATCH" }, { status: 403 });
  const derivedKey = crypto.createHmac("sha256", (process.env.REVCLAMP_WEBHOOK_SECRET || "").trim()).update(JSON.stringify([scope, payload.tenant_id || "default", payload.account_id || "default"])).digest("hex");
  const expectedV1 = crypto.createHmac("sha256", derivedKey).update(t + "." + rawBody, "utf8").digest("hex");
  if (!crypto.timingSafeEqual(Buffer.from(v1, "hex"), Buffer.from(expectedV1, "hex"))) return Response.json({ ok: false, error: "INVALID_SIGNATURE" }, { status: 401 });
  await db.tenants.update({ where: { stripeCustomerId: payload.customer_id, transitionSeq: { lt: payload.transition_seq } }, data: { apiAccessPaused: payload.event === "revclamp.entitlement.revoke", transitionSeq: payload.transition_seq } });
  return Response.json({ ok: true, customer_id: payload.customer_id, handled: payload.event });
}

// 1. Check Customer Protection Status (stripe.dashboard.customer.detail)
const cusRes = await fetch(
  "https://api.revclamp.com/v1/stripe/customer-drawer?customer_id=" + encodeURIComponent(customerId),
  { headers: { "X-RevClamp-Tenant-Key": "<YOUR_TENANT_KEY>" } }
);
const { ok: cusOk, drawer: customerDrawer } = await cusRes.json();

// 2. Stage Chargeback Evidence Draft (stripe.dashboard.dispute.detail)
const dispRes = await fetch("https://api.revclamp.com/v1/stripe/dispute-drawer", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-RevClamp-Tenant-Key": "<YOUR_TENANT_KEY>"
  },
  body: JSON.stringify({ existingDispute, expectedCustomerId: customerId, usageEvents })
});
const { ok: dispOk, drawer: disputeDrawer } = await dispRes.json();

Zero-Risk & Fail-Open CTO Architecture Guarantees

PostHog Webhook Settings (Zero-Code)

Automatic Stripe Events Handled by RevClamp