Skip to content

fix(billing): register the Stripe plugin only when the webhook secret is configured #9363

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
waleedlatif1 merged 2 commits into from
Oct 24, 2026
Merged

fix(billing): register the Stripe plugin only when the webhook secret is configured #9363

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3940956
fix(billing): register the Stripe plugin only when the webhook secret…
waleedlatif1 Oct 24, 2026
bc2ad3e
fix(billing): treat a whitespace-only Stripe webhook secret as missing
waleedlatif1 Oct 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 24 additions & 11 deletions apps/sim/lib/auth/auth.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,15 +237,28 @@ if (env.NODE_ENV === 'production') {
}
}

const validStripeKey = env.STRIPE_SECRET_KEY

let stripeClient = null
if (validStripeKey) {
stripeClient = new Stripe(env.STRIPE_SECRET_KEY || '', {
apiVersion: '2025-08-27.basil',
})
/**
* Resolves the Stripe billing plugin's client and webhook signing secret, or `null` when the plugin
* must not register. Stripe's verifier accepts a signature computed with an empty key, so a missing
* `STRIPE_WEBHOOK_SECRET` disables the plugin rather than exposing a forgeable webhook receiver.
*/
function resolveStripeBilling() {
if (!isBillingEnabled || !env.STRIPE_SECRET_KEY) return null
const webhookSecret = env.STRIPE_WEBHOOK_SECRET
if (!webhookSecret?.trim()) {
logger.error(
'BILLING_ENABLED and STRIPE_SECRET_KEY are set but STRIPE_WEBHOOK_SECRET is not; the Stripe billing plugin is disabled until it is configured'
)
return null
}
return {
client: new Stripe(env.STRIPE_SECRET_KEY, { apiVersion: '2025-08-27.basil' }),
webhookSecret,
}
}

const stripeBilling = resolveStripeBilling()

/**
* Resolves the org's API instance URL for a freshly linked Salesforce account.
*
Expand Down Expand Up @@ -967,7 +980,7 @@ export const auth = betterAuth({
banned: false,
banReason: null,
banExpires: null,
...(isBillingEnabled && stripeClient ? { stripeCustomerId: null } : {}),
...(stripeBilling ? { stripeCustomerId: null } : {}),
...additionalFields,
id,
}),
Expand Down Expand Up @@ -1547,11 +1560,11 @@ export const auth = betterAuth({
* SSO provider behind it.
*/
...(isSsoEnabled ? [configuredSsoPlugin] : []),
...(isBillingEnabled && stripeClient
...(stripeBilling
? [
stripe({
stripeClient,
stripeWebhookSecret: env.STRIPE_WEBHOOK_SECRET || '',
stripeClient: stripeBilling.client,
stripeWebhookSecret: stripeBilling.webhookSecret,
createCustomerOnSignUp: true,
onCustomerCreate: async ({ stripeCustomer, user }) => {
logger.info('[onCustomerCreate] Stripe customer created', {
Expand Down
2 changes: 1 addition & 1 deletion packages/sim-setup/src/checks.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -469,7 +469,7 @@ function checkCoherence(ctx: CheckContext): Finding[] {
}> = [
{
flag: 'BILLING_ENABLED',
needs: ['STRIPE_SECRET_KEY'],
needs: ['STRIPE_SECRET_KEY', 'STRIPE_WEBHOOK_SECRET'],
label: 'billing',
},
{
Expand Down
Loading