Stripe Trigger
Triggers a workflow when events occur in your Stripe account. Webhook endpoints are automatically registered with Stripe when the workflow is published — no manual setup required.
Requires a Stripe connection with a valid API key.
Configuration
| Field | Description | Notes |
|---|---|---|
| Connection | Stripe connection to use | Required |
| Events | Stripe event types to subscribe to | Required. Multiple selection. Use All events to receive every event type. |
Common Events
| Event | Description |
|---|---|
payment_intent.succeeded | Payment intent succeeded |
payment_intent.payment_failed | Payment intent failed |
charge.succeeded | Charge succeeded |
charge.failed | Charge failed |
charge.refunded | Charge refunded |
checkout.session.completed | Checkout session completed |
invoice.paid | Invoice paid |
invoice.payment_failed | Invoice payment failed |
customer.created | Customer created |
customer.subscription.created | Subscription created |
customer.subscription.deleted | Subscription cancelled |
dispute.created | Dispute created |
Stripe's full event catalogue is available in the Stripe API reference.
Output
The trigger passes the full Stripe event payload to downstream nodes:
| Field | Description |
|---|---|
body | Parsed JSON payload from Stripe (event object) |
body.type | Event type (e.g., payment_intent.succeeded) |
body.data.object | The Stripe object that the event is about (Charge, PaymentIntent, etc.) |
headers.Stripe-Signature | Signature header (already verified before the workflow runs) |
How It Works
- You configure the trigger with a connection and a list of events.
- When you publish the workflow, the system calls Stripe's Create Webhook Endpoint API and stores both the returned endpoint ID and the signing secret.
- When you re-publish or delete the workflow, the old endpoint is deleted and a fresh one is created (with a new signing secret).
- Every incoming webhook is verified using Stripe's signature scheme: HMAC-SHA256 over
{timestamp}.{rawBody}with the per-endpoint signing secret. Deliveries older than 5 minutes are rejected as replay attempts. Requests with missing or invalid signatures are rejected with401 Unauthorized.
Security
The signing secret is generated by Stripe at registration time and stored only on the workflow's webhook record. It is never exposed in the UI or in workflow outputs. If you suspect the secret has leaked, unpublish and re-publish the workflow to rotate it.