Stack guide
Managing Stripe Connect webhooks with Terraform
Webhook endpoints drift the way all configuration drifts: someone clicks in a dashboard during an incident, staging diverges from production, and six months later nobody knows which environment subscribes to which events. Terraform makes endpoint configuration reviewable and reproducible — including the eight events a Connect-monitoring receiver requires and the per-organisation endpoint pattern attribution depends on.
The resource shape
Endpoint plus subscribed events, codified:
resource "stripe_webhook_endpoint" "receiver" {
url = "https://app.example.com/api/webhooks/stripe/${var.organization_id}"
enabled_events = [
"charge.refunded",
"application_fee.refunded",
"charge.dispute.created",
"charge.dispute.closed",
"transfer.reversed",
"payout.failed",
"balance.available",
"account.application.deauthorized",
]
}Per-organisation endpoints
Multi-tenant receivers name organisations in paths because balance/payout events carry no account field — routing rides on URL structure. IaC expresses this cleanly via variables; dashboard-click provisioning cannot, which is how tenants end up sharing misattributed endpoints.
Secret rotation without downtime
Signing-secret rotation sequenced through dual-endpoint overlap avoids the blind window single-endpoint swaps create. Plan rotation as infrastructure events with runbooks, not console heroics during incidents.
Common questions
Multiple environments?
One endpoint per environment per organisation, naming convention enforced via variables. Drift detection reports divergence before incidents exploit it.
Does this require a FeeGuard integration?
No — the page stands alone as stack guidance. FeeGuard observes your event stream externally rather than embedding in it.