360 Secure SkillHub
360 安全技能中心

Stripe Webhook Replay Lab

该 Skill 通过 bash 脚本读取 Stripe 事件载荷与签名密钥，生成 Stripe-Signature 头，按配置次数把同一事件重放至指定端点，并打印每次 HTTP 状态码、耗时及通过/失败汇总，用于调试幂等性和重复投递。

分类：开发
daniellummis
daniellummis
热度 32.74
最近更新 2026-05-11 17:28:58

安装

发给 Agent
帮我安装这个技能：npx secure-skills-cli add daniellummis/stripe-webhook-replay-lab
兼容性
通用兼容
联网要求
需要联网
数据出网
可选出网
Metadata
name
stripe-webhook-replay-lab
description
Replay signed Stripe webhook payloads to a local or staging endpoint for idempotency and retry debugging.
version
1.0.0
metadata
{"openclaw":{"requires":{"bins":["bash","curl","openssl","python3"]}}}

Stripe Webhook Replay Lab

Use this skill to replay the same signed Stripe webhook event multiple times against your endpoint and validate idempotency behavior.

What this skill does

  • Loads a Stripe event payload from a JSON file or inline env var
  • Generates valid Stripe Stripe-Signature headers using your webhook secret (whsec_...)
  • Replays the exact same payload N times to simulate duplicate deliveries/retries
  • Prints per-attempt HTTP status and latency with a pass/fail summary

Inputs

Required:

  • STRIPE_WEBHOOK_URL (target endpoint)
  • STRIPE_WEBHOOK_SECRET (Stripe endpoint secret used to verify signatures)

Payload source (choose one):

  • STRIPE_EVENT_PATH (default: fixtures/sample-checkout-session-completed.json)
  • STRIPE_EVENT_JSON (inline JSON payload; overrides STRIPE_EVENT_PATH)

Optional:

  • REPLAY_COUNT (default: 2)
  • REPLAY_DELAY_SECONDS (default: 0)
  • REQUEST_TIMEOUT_SECONDS (default: 15)
  • ACCEPT_HTTP_CODES (comma-separated exact HTTP codes accepted as success; default empty = any 2xx)

Run

STRIPE_WEBHOOK_URL=http://localhost:8000/webhooks/stripe \
STRIPE_WEBHOOK_SECRET=whsec_test_123 \
bash scripts/replay-stripe-webhook.sh

Force five duplicate deliveries with a small delay:

STRIPE_WEBHOOK_URL=http://localhost:8000/webhooks/stripe \
STRIPE_WEBHOOK_SECRET=whsec_test_123 \
REPLAY_COUNT=5 \
REPLAY_DELAY_SECONDS=0.2 \
bash scripts/replay-stripe-webhook.sh

Use inline payload JSON:

STRIPE_WEBHOOK_URL=http://localhost:8000/webhooks/stripe \
STRIPE_WEBHOOK_SECRET=whsec_test_123 \
STRIPE_EVENT_JSON='{"id":"evt_test","type":"checkout.session.completed","object":"event","data":{"object":{"id":"cs_test"}}}' \
bash scripts/replay-stripe-webhook.sh

Output contract

  • Prints payload event id/type when available
  • Logs each replay attempt: status code + elapsed milliseconds
  • Exit 0 if all attempts pass success criteria
  • Exit 1 if any attempt fails or inputs are invalid