Webhooks
How Creem payment webhooks are processed for Pro delivery.
Endpoint
POST /api/payments/creem/webhookSecurity
Signature verification
Every webhook is verified with HMAC-SHA256 via verifyWebhookSignature and CREEM_WEBHOOK_SECRET. Timing-safe comparison is used.
Idempotency
Duplicate deliveries are ignored by checking providerPaymentId in the payment table before granting access again.
Supported events
| Event | Action |
|---|---|
checkout.completed | Record payment, deliver Pro (GitHub invite), send confirmation email |
| Other Creem events | Acknowledged per handler — Pro is a one-time product |
Setup
In the Creem Dashboard, set the webhook URL to:
https://www.aicostgate.com/api/payments/creem/webhookAnd configure:
CREEM_WEBHOOK_SECRET="whsec_your_secret"Debugging
- Check Creem Dashboard webhook delivery logs
- Confirm
CREEM_WEBHOOK_SECRETmatches Creem - Ensure the endpoint is publicly reachable
- Confirm GitHub token can invite collaborators