Package com.stripe.net

Class Webhook

java.lang.Object

com.stripe.net.Webhook

public final class Webhook
extends Object

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static final class	Webhook.Signature
static final class	Webhook.Util

Field Summary

Fields

Modifier and Type	Field	Description
static final long	DEFAULT_TOLERANCE

Constructor Summary

Constructors

Constructor	Description
Webhook()

Method Summary

Modifier and Type	Method	Description
static Event	constructEvent(String payload, String sigHeader, String secret)	Returns an Event instance using the provided JSON payload.
static Event	constructEvent(String payload, String sigHeader, String secret, long tolerance)	Returns an Event instance using the provided JSON payload.
static Event	constructEvent(String payload, String sigHeader, String secret, long tolerance, Clock clock)	Constructs a snapshot event from an incoming webhook after verifying its authenticity.
static Event	constructEventWithoutVerification(String payload)	Constructs a snapshot event from an incoming webhook without first verifying its authenticity.
static com.google.gson.JsonObject	maybeExtractFromCloudProviderEnvelope(String payload)	Parses a JSON payload (or cloud provider envelope) and returns the inner Stripe event JSON object.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DEFAULT_TOLERANCE

public static final long DEFAULT_TOLERANCE

See Also:

• Constant Field Values

Constructor Details

Webhook

public Webhook()

Method Details

constructEvent

public static Event constructEvent(String payload,
 String sigHeader,
 String secret)
                            throws SignatureVerificationException

Returns an Event instance using the provided JSON payload. Throws a JsonSyntaxException if the payload is not valid JSON, and a SignatureVerificationException if the signature verification fails for any reason.

Parameters:

payload - the payload sent by Stripe.

sigHeader - the contents of the signature header sent by Stripe.

secret - secret used to generate the signature.

Returns:

the Event instance

Throws:

SignatureVerificationException - if the verification fails.

constructEvent

public static Event constructEvent(String payload,
 String sigHeader,
 String secret,
 long tolerance)
                            throws SignatureVerificationException

Returns an Event instance using the provided JSON payload. Throws a JsonSyntaxException if the payload is not valid JSON, and a SignatureVerificationException if the signature verification fails for any reason.

Parameters:

payload - the payload sent by Stripe.

sigHeader - the contents of the signature header sent by Stripe.

secret - secret used to generate the signature.

tolerance - maximum difference in seconds allowed between the header's timestamp and the current time

Returns:

the Event instance

Throws:

SignatureVerificationException - if the verification fails.

constructEvent

public static Event constructEvent(String payload,
 String sigHeader,
 String secret,
 long tolerance,
 Clock clock)
                            throws SignatureVerificationException

Constructs a snapshot event from an incoming webhook after verifying its authenticity. To work with a webhook that has already been verified (i.e. one from a cloud provider, an asynchronous queue, or during testing), see constructEventWithoutVerification.

Parameters:

payload - the payload sent by Stripe.

sigHeader - the contents of the signature header sent by Stripe.

secret - secret used to generate the signature.

tolerance - maximum difference in seconds allowed between the header's timestamp and the current time

clock - instance of clock if you want to use custom time instance

Returns:

the Event instance

Throws:

SignatureVerificationException - if the verification fails.

constructEventWithoutVerification

public static Event constructEventWithoutVerification(String payload)

Constructs a snapshot event from an incoming webhook without first verifying its authenticity. Should be used after calling Webhook.Signature.verifyHeader(...) or with input from a trusted source (such as AWS EventBridge, or Azure Event Grid payload). Or, to verify & construct in a single call, use Webhook.constructEvent(...) instead.

Parameters:

payload - the payload sent by Stripe, or a cloud provider envelope wrapping it.

Returns:

the Event instance

Throws:

IllegalArgumentException - if the payload is a v2 thin event notification.

maybeExtractFromCloudProviderEnvelope

public static com.google.gson.JsonObject maybeExtractFromCloudProviderEnvelope(String payload)

Parses a JSON payload (or cloud provider envelope) and returns the inner Stripe event JSON object. If the payload is already a raw Stripe event (object is "event" or "v2.core.event"), it is returned as-is. If it is an AWS EventBridge or Azure Event Grid envelope, the inner event is extracted. Throws IllegalArgumentException for unrecognized formats.

Parameters:

payload - the raw JSON string.

Returns:

the inner event as a JsonObject.