Polar Webhooks

When to Use This Skill

• How do I receive Polar webhooks?
• How do I verify Polar webhook signatures?
• How do I handle order.paid, subscription.created, or checkout.updated events?
• Why is my Polar webhook signature verification failing?
• Setting up a Polar webhook endpoint in organization settings

Verification (core)

Polar follows the Standard Webhooks spec. Each request carries three headers — webhook-id, webhook-timestamp, and webhook-signature — and the signature is an HMAC-SHA256, base64-encoded, over {webhook-id}.{webhook-timestamp}.{body}. Always verify against the raw request body — don't JSON.parse first.

Use Polar's official SDK helpers, which parse and verify in one call: