New to VisionScaper?
Start here
Help Center › Get your API keys › Get your Stripe webhook signing secret
Get your Stripe webhook signing secret
Add VisionScaper's address in Stripe, pick the events it needs, and copy the whsec_ signing secret.
A webhook is how Stripe tells your website that something happened, such as a finished payment. The signing secret lets VisionScaper check that the message really came from Stripe. This article shows how to create the webhook and copy the secret.
Before you start
- Your Stripe secret key is saved (see “Get your Stripe secret key”).
- Your site uses HTTPS. Stripe accepts only public HTTPS addresses for live mode.
Steps
- In WordPress, go to Settings → VisionScaper and find Selling extra AI credits. The page prints the webhook address in step 3 of its instructions. It ends in
/wp-json/dreamscaper/v1/stripe. Copy the full address from that page. (The word in the path is only a technical address, not a product name.) - In the Stripe Dashboard, open the Webhooks tab in Workbench (
dashboard.stripe.com/webhooks). - Click Create an event destination.
- Select Your account so Stripe sends events from your own account.
- Choose the payload format. VisionScaper reads the normal event object (
type,data.object), so pick Snapshot and choose an API version if Stripe asks. Stripe’s page says thin events need a different kind of endpoint. (That Snapshot is the right choice is based on how the plugin reads events; it is not tested.) - Select the event types in the table below.
- Click Continue, choose Webhook endpoint as the destination type, and click Continue again.
- Paste the address from step 1 into Endpoint URL. Add a description if you like.
- On the webhook settings page, find the signing secret that starts with
whsec_. Click Reveal secret and copy it. - Back in Settings → VisionScaper, paste it into Stripe webhook signing secret. Save.
Events VisionScaper reacts to
The on-screen instructions list only checkout.session.completed. The code also handles these, so select them if you use the matching feature:
| Event | Used for |
|---|---|
checkout.session.completed |
Credit purchases, plan sign-ups, paid invoices |
checkout.session.async_payment_succeeded |
Bank payments that clear later |
checkout.session.async_payment_failed |
Reopens an invoice when a bank payment fails |
customer.subscription.created, .updated, .deleted, .paused, .resumed |
Keeps contractor plans in step with Stripe |
invoice.paid, invoice.payment_failed |
Records subscription payments |
account.updated |
Marks a contractor’s Stripe account as ready |
account.updated comes from connected accounts, which Stripe delivers to a separate destination scoped to Connected accounts. That second destination has its own signing secret, and VisionScaper has only one secret field. The code also checks account status when a contractor taps Check status, so this event is a convenience. How to use two secrets is not verified in code.
Tips
- VisionScaper rejects a message if its time stamp is more than 10 minutes old, so keep your server clock correct.
- If Stripe shows deliveries as
Failed, open the destination’s Event deliveries tab and read the status code. - Test mode and live mode have different secrets. Update the field when you switch.
If something goes wrong
- Stripe shows 400. The secret in VisionScaper does not match the destination, or it is blank.
- Stripe shows a redirect (3xx). Use the exact final address, including
https://and no extra redirect from your host. - Credit purchases still work without a webhook. The plugin also confirms credits when the customer returns to the site, so a missed webhook does not lose a purchase.
Sources
- Stripe, webhooks: https://docs.stripe.com/webhooks (read 2026-10-15)
- Stripe, API keys (webhook secrets are separate from keys): https://docs.stripe.com/keys
- Plugin code: billing.php, crm-pay.php, subs.php (events handled).