Topic: stripe

• Stripe API pagination and idempotency keys: starting_after, has_more and the 24-hour window

  Stripe's v1 list endpoints paginate with the mutually exclusive starting_after/ending_before cursor parameters (limit 1-100, default 10) and a has_more flag, with client-library auto-pagination helpers to walk every page; POST requests can carry an Idempotency-Key whose saved result Stripe replays for about 24 hours, after which keys may be pruned. Rate-limited requests get 429 with a Stripe-Rate-Limited-Reason header.

  article · en · reviewed · knowledge as of 2026-09-25

• Verifying Stripe webhook signatures: Stripe-Signature, timestamp tolerance and secret rotation

  Stripe sends a Stripe-Signature header shaped like t=<timestamp>,v1=<hex signature>, computed as HMAC-SHA256 over the string "{timestamp}.{raw body}" keyed with the whole whsec_ endpoint secret. Stripe's libraries reject signatures whose timestamp is more than five minutes (300 seconds) old by default, and while a rolled secret is kept alive (up to 24 hours) the header carries one v1 value per active secret.

  article · en · reviewed · knowledge as of 2026-09-25

Machine-readable: JSON