What you'll have at the end

A Route Handler reading the raw body with req.text(), checking it against the Stripe-Signature header, and returning 200 only once it checks out

Before you start

You need

A working Stripe integration that already takes real payments, and a Route Handler meant to receive its webhook events.

Not covered

Setting up Stripe Checkout or the payment flow itself, or building a full retry and dead-letter pipeline for webhook processing at scale.

Leans on

Where to go next

Guard private routes with middleware, then check again on the server

the caller there is a signed-in visitor, so the second check re-verifies a session instead of a signed payload from an outside service.

This NEXT_PUBLIC variable still reads undefined in the browser

the same env-var placement question appears there for a value meant to reach the browser, rather than one that must stay on the server only.