dodo-webhook

Wire Dodo Payments webhooks end-to-end — signature verification, event routing, idempotency, and database sync. Three specific mistakes will silently break this. All three are covered.

Why This Exists

Dodo uses the Standard Webhooks spec. This is different from Stripe. The mistakes that will burn you:

1. Using the raw DODO_WEBHOOK_SECRET string for verification — it won't work. The secret comes in whsec_xxxxx format. You must strip the whsec_ prefix and base64-decode the rest before using it. This fails silently in log-only mode, so you'll think verification works until you test strictly.
2. Letting any middleware parse the body as JSON before you verify. Signature verification happens over the raw body bytes. Once it's parsed and re-serialized, the bytes change and verification fails.
3. Returning non-200 on processing errors. Dodo retries any non-200. If your handler throws and returns 500, you'll process the same payment event over and over.

Phase 1: Detect the Stack

Check the codebase:

• Framework: Next.js App Router / Pages Router / FastAPI / Express?
• Database ORM: Prisma / Drizzle / Supabase / Mongoose / raw SQL?
• User model: What field stores plan/credits? How is userId stored?
• Existing webhook routes: Any /api/webhooks/ directory already?

Phase 2: Install Dependencies