Stripe Webhook Delivery
Deliver Stripe events — charges, invoices, disputes, payment intents, subscription updates — to public HTTP targets with no customer-side runtime, or to services behind your corporate firewall or NAT without opening inbound ports.
The Problem
Stripe sends webhooks to a public URL. If your billing, reconciliation, or fraud detection services run inside a private network — behind a corporate firewall, NAT gateway, or VPN — they have no public address. Stripe can't reach them directly, so you end up polling Stripe's API, running a public relay, or opening inbound firewall rules.
Why This Is Hard
Stripe's webhook signature verification (using stripe-signature with your webhook secret)
is essential for security, but it only verifies that the payload came from Stripe — not that the
delivery path to your internal service is secure. Most setups expose a public endpoint that receives
the webhook, then proxy it inward, creating an additional attack surface.
How Zen Mesh Helps
Zen Mesh provides a Stripe-ready webhook endpoint. You choose how events reach your service:
Option 1: Managed Public Delivery (no customer-side runtime)
For supported inbound webhook workflows, Zen Mesh provides a direct managed alternative: create a public webhook endpoint, validate and process events, and deliver to a public HTTPS destination without installing an agent, container, or Kubernetes component. The Stripe template validates stripe-signature headers at the ingress plane. Point your Stripe endpoint to Zen Mesh, and events are delivered to your public HTTPS target. No agent, no Docker, no Kubernetes.
Option 2: Private Edge Delivery (outbound-only)
When the same destination is private, Zen Mesh can extend the flow through Edge using outbound-only connectivity, without publishing the target or opening inbound firewall access. Stripe events arrive at the same Zen Mesh endpoint. If your target billing or reconciliation service is behind a firewall, Edge delivers through an outbound-only tunnel. No inbound ports, no public relay inside your perimeter.
Both options share the same Stripe template, signature verification, retry/DLQ policies, and operational visibility — only the delivery path differs.
Stripe Template Pack
The Stripe template includes pre-configured defaults for endpoint setup, signature verification parameters, event type classification, and operational visibility — so you don't wire each field from scratch.
Runtime Path
Select the Stripe template from the Zen Mesh Registry.
Apply Stripe defaults: endpoint URL, stripe-signature verification, event mapping.
Define which Stripe events route to which internal service — charges, invoices, disputes, etc.
Bind the Stripe endpoint, blueprint, and private target into a delivery flow.
Point delivery at your internal billing or reconciliation service — no open ingress required.
Security & Evidence
Stripe webhook signatures validated at ingress. Delivery uses mTLS + HMAC on the data plane. Each delivery produces a delivery receipt with operational metadata. See Security for scope and maturity. Review per-capability status in claim-maturity and the non-claims registry.
Current Status
Stripe templates are available as part of the Provider Template Pack (V1). Signature verification for supported provider templates is validated in local/sandbox. Free Forever and Pro Early Bird tiers include Stripe support. Evidence system tracks per-capability status — local/sandbox validation, production-live validation, and planned capabilities are distinguished.
FAQ
Can I receive Stripe webhooks without installing any agent or runtime?
Yes. Managed Public Delivery delivers Stripe events to a public HTTPS target with no customer-side runtime. Point Stripe to your Zen Mesh endpoint and events are delivered directly — no agent, no Docker, no Kubernetes.
How do I receive Stripe webhooks behind a firewall?
Use Private Edge Delivery. Edge connects outbound to Zen Mesh from inside your network, so Stripe events reach your private billing service without opening inbound firewall ports.
Does Zen Mesh verify Stripe signatures?
Yes. The Stripe template validates stripe-signature headers at the ingress plane before any payload reaches your network. Tampered payloads are rejected before delivery.
Can I route different Stripe events to different services?
Yes. Define blueprints that map Stripe event types — charges, invoices, disputes, payment intents — to separate internal targets. Each event type follows its own delivery path.
Ready to try Stripe delivery?
Two delivery modes. One Stripe template. Free Forever tier available.