CLI workflow

Test Stripe Webhooks with a CLI

Forward test events to a local endpoint, trigger a known fixture, and verify signature handling and idempotency.

HTTP and webhooksRemote write

Prepare tools, authentication, and evidence first

Install the recommended tools, confirm minimum permissions, and keep compatibility separate from real execution records.

stripedocs-verified
Test webhooks, inspect events, and use test-mode Stripe workflows with explicit approval boundaries.

Recommended install

$ shell
brew install stripe/stripe-cli/stripe
Authentication
browser login, restricted API key
Tested agents
No agent-specific execution record
Evidence status
docs-verified · Documentation checked 2026-07-10
Independent CLI execution
No independently executed version recorded

Copy or download this workflow Skill

The Skill includes input and output contracts, recommended tools, approval points, rollback, and evidence boundaries. Review it against the active environment before saving.

test-stripe-webhooks-SKILL.md
---
name: test-stripe-webhooks-workflow
description: "Forward test events to a local endpoint, trigger a known fixture, and verify signature handling and idempotency."
---

# Test Stripe webhooks

## Intended outcome

Prove a webhook handler accepts and processes test events without touching live customers or money.

## Evidence boundary

- Tool status distinguishes `docs-verified` material from independent execution; the two are not interchangeable.
- The current registry does not attribute a tool execution to a particular agent, so compatible agents cannot be called tested agents.
- Reconfirm the target account, environment, version, and official documentation before execution.
- Never auto-execute an R2, R3, or confirmation-marked step; obtain explicit approval immediately before it runs.

## Recommended tools, installation, and authentication

- **Stripe CLI** (evidence: `docs-verified`, docs checked: `2026-07-10`, no independently executed version recorded)
  - Install: `brew install stripe/stripe-cli/stripe`
  - Authentication: browser login, restricted API key
  - Minimum permissions: Use a restricted test-mode key and verify account and livemode before every write.

## Input contract

- Local webhook URL
- Stripe test account
- event type
- expected application state

## Output contract

- Forwarding session
- test event ID
- handler logs
- delivery and state assertions

## Safe workflow

1. **Start test forwarding** — Authenticate to the intended test account and forward events to the local handler.
   - Input: Test account and local endpoint
   - Output: Webhook signing secret and forwarding session
   - Risk: `read-only`
   - Command: `stripe listen --forward-to localhost:3000/api/webhooks/stripe`
2. **Trigger a fixture** — Generate a documented test event, keeping the event type and account visible.
   - Input: Chosen test event type
   - Output: Test event and delivery attempt
   - Risk: `remote-write`
   - Command: `stripe trigger payment_intent.succeeded`
3. **Verify behavior** — Check status code, signature validation, idempotency, logs, and expected test data.
   - Input: Delivery output and application logs
   - Output: Pass/fail assertions with event ID
   - Risk: `read-only`

## Ask before proceeding

- Using any live-mode credential or command
- Triggering events in a shared test account
- Creating, refunding, or canceling real payment objects

## Rollback

- Delete disposable test fixtures when appropriate
- Reset local test data with the project’s fixture workflow
- Never treat a compensating live payment as a test rollback

## Official sources

- [Stripe CLI documentation](https://docs.stripe.com/stripe-cli) — Official CLI guidance for test events, webhook forwarding, logs, and resources.

Outcome, inputs, and outputs

Define the result and evidence before the agent selects a command.

Goal

Prove a webhook handler accepts and processes test events without touching live customers or money.

Required inputs

  • Local webhook URL
  • Stripe test account
  • event type
  • expected application state

Expected outputs

  • Forwarding session
  • test event ID
  • handler logs
  • delivery and state assertions

Test Stripe Webhooks with a CLI: safe workflow

Run each step inside its stated boundary and verify the output before continuing.

Step 1Read only

Start test forwarding

Authenticate to the intended test account and forward events to the local handler.
Input
Test account and local endpoint
Output
Webhook signing secret and forwarding session
$ Start test forwarding
stripe listen --forward-to localhost:3000/api/webhooks/stripe
Step 2Remote write

Trigger a fixture

Generate a documented test event, keeping the event type and account visible.
Input
Chosen test event type
Output
Test event and delivery attempt
$ Trigger a fixture
stripe trigger payment_intent.succeeded
Step 3Read only

Verify behavior

Check status code, signature validation, idempotency, logs, and expected test data.
Input
Delivery output and application logs
Output
Pass/fail assertions with event ID

Approval points and rollback

Pause at the listed decision points and keep recovery instructions beside the action.

Ask before these actions

  • Using any live-mode credential or command
  • Triggering events in a shared test account
  • Creating, refunding, or canceling real payment objects

Recovery plan

  • Delete disposable test fixtures when appropriate
  • Reset local test data with the project’s fixture workflow
  • Never treat a compensating live payment as a test rollback

CLI, MCP, or API?

Choose the interface by execution location, identity, output contract, and permission boundary.

CLI

Best for local forwarding, event fixtures, logs, and repeatable development checks.

MCP

Useful only when a mediated integration clearly separates test and live actions.

API

Use for custom fixture creation or assertions that require fields beyond the CLI workflow.

Recommended approach

Keep the default workflow entirely in Stripe test mode and verify the account before every trigger.

Official evidence and references

Use these primary or upstream sources to verify current command behavior before acting.

Stripe CLI documentation

Official CLI guidance for test events, webhook forwarding, logs, and resources.

Questions before you run it

Does stripe trigger affect live data?

It should be used with test-mode context, but always verify the authenticated account and mode before running it.

Should the signing secret be saved?

Treat it as a secret. Put it in the local secret mechanism for the test session, not source control or reports.

Related tools and guides

Browse sibling guides and choose the next page that best matches the active task.

Continue with tool evidence, a workflow, or a decision guide related to this task.

Continue with tool evidence, a workflow, or a decision guide related to this task.

Continue with tool evidence, a workflow, or a decision guide related to this task.