Test Stripe Webhooks Online

Using the Stripe CLI with MockFlow

The Stripe CLI can forward events to your MockFlow catcher URL. MockFlow stores each event so you can inspect it, then replay it to another public HTTP or HTTPS endpoint.

# Forward all Stripe events to your MockFlow catcher
stripe listen --forward-to \
  https://api.mockflow.io/my-project--abc123/catch/xyz

# Stripe CLI output:
# > Ready! Your webhook signing secret is whsec_...
# > 2026-05-30 payment_intent.succeeded [evt_abc]
# > 2026-05-30 invoice.payment_succeeded [evt_def]

# MockFlow captures each event.
# Open the MockFlow catcher inspector to see full payloads.

# MockFlow Replay → target URL: https://staging.example.com/webhooks/stripe
# MockFlow sends the captured request body and headers to that public URL.

# The staging handler receives:
POST /webhooks/stripe HTTP/1.1
Host: staging.example.com
Stripe-Signature: t=1234567890,v1=abc...
Content-Type: application/json

{
  "id": "evt_abc123",
  "type": "payment_intent.succeeded",
  "data": { "object": { ... } }
}

Verifying the Stripe Webhook Signature

MockFlow captures the raw Stripe-Signature header. Use it to verify your signature validation logic is correct.

// Node.js / Next.js webhook handler
import Stripe from "stripe";

const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);

export async function POST(req: Request) {
  const body = await req.text();
  const sig = req.headers.get("stripe-signature")!;

  let event: Stripe.Event;

  try {
    event = stripe.webhooks.constructEvent(
      body,
      sig,
      process.env.STRIPE_WEBHOOK_SECRET!
    );
  } catch (err) {
    return Response.json({ error: "Signature verification failed" }, { status: 400 });
  }

  // Handle event types
  switch (event.type) {
    case "payment_intent.succeeded":
      // fulfill order
      break;
    case "customer.subscription.deleted":
      // downgrade account
      break;
  }

  return Response.json({ received: true });
}

Use MockFlow replay to send the captured Stripe event to your handler and confirm the verification passes before deploying.

Related Resources