Your Paddle Webhook Is Signed. The Seat Count Is Not.
Paddle custom_data can come from browser checkout code. Verify the signature, then grant seats from paid line items, not client metadata.
Written by
Building tools for API integration testing. Creator of fetchsandbox.com
Engineer who's spent too long debugging webhook signatures and flaky staging servers. Building FetchSandbox — turn any OpenAPI spec into a stateful API sandbox in seconds.
Responses
Markdown supported · ⌘↵ to post
No responses yet.