Payments and entitlements
Same event processed twice
A delivered-twice event credits a customer twice or sends two emails.
Termswebhook (a message a provider such as Stripe sends to your server when something happens, like a payment) · raw body (the request bytes exactly as sent; signature checks fail if a framework parses them first) · idempotency key (an identifier stored per processed event so a duplicate delivery changes nothing) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server)
highseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Stripe documents that endpoints may receive the same event more than once and recommends logging processed event ids; generated handlers act on every delivery.
Stripe signs every webhook event; without verification an attacker could send fake events to trigger order fulfilment or grant access. Official libraries reject events older than 5 minutes by default, endpoints may receive the same event more than once, and Stripe does not promise delivery order.
Source: Stripe docs, 2026-09 · verified 2026-09-21
How we detect it
Deliver one event id twice and count the state changes.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Stacks: Stripe
Checklist items that catch it
Duplicate and out-of-order events are handled once
automated Deliver the same event id twice and deliver invoice.paid before customer.subscription.created.
Exactly one state change per event id; the out-of-order pair ends in the correct final state.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in payments and entitlements
- critical
- critical
- critical
- high
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.