Stripe callback

Handle OrgX Content Studio payment callbacks from Stripe.

The currently published provider callback is an inbound Stripe webhook for Content Studio checkout events. It is not a general-purpose outbound OrgX event-delivery API.

Stripe sends this callback to OrgX. You do not register an OrgX endpoint or call this route from your integration.

Endpoint

POST https://useorgx.com/api/v1/studio/callback

The handler reads the raw request body and requires Stripe’s stripe-signature header. Verify the signature with an official Stripe library before any parsing or processing. See Stripe’s webhook signature verification guide.

Do not parse or reserialize the body before signature verification. Stripe’s signed payload must be passed to verification exactly as received.

Events handled

OrgX handles these Stripe event types:

• checkout.session.completed
• checkout.session.expired
• payment_intent.payment_failed

Unsupported event types receive a success response after signature verification so Stripe does not retry an event that OrgX intentionally does not handle.

Response and failure behavior

Situation	Response
Missing stripe-signature	400
Invalid Stripe signature	400
Stripe configuration missing	500
Event handler failure	500
Successfully received or ignored event	200 with { "received": true }

Return a successful response quickly after the event is accepted. Stripe may retry failed deliveries, events can arrive out of order, and duplicate event notifications are possible; follow Stripe’s webhook delivery guidance for queueing, replay, and secret rotation.

Minimal handler shape

export async function POST(request: Request) {
  const signature = request.headers.get('stripe-signature');
  const body = await request.text();

  if (!signature || !verifyStripeSignature(body, signature)) {
    return new Response('invalid signature', { status: 400 });
  }

  const event = JSON.parse(body);
  await processStripeEvent(event);

  return Response.json({ received: true });
}

Outbound OrgX event delivery is not part of this published contract. Do not infer an outbound webhook API from this inbound Stripe callback.