Webhook fix guides

Short guides for the problems we see most. Each one ends with how to check your fix.

• Stripe webhook to a Supabase edge function returns 401

  Supabase edge functions check for a login token by default. Stripe does not send one. So Supabase says no before your code runs.

• Your Stripe webhook works on your laptop but fails in production

  On your laptop you use a secret from the Stripe CLI. In production you need a different secret. Most failures come from that, or from something that blocks Stripe before your code runs.

• Lemon Squeezy webhook says the signature is invalid

  Lemon Squeezy signs the raw request body with HMAC SHA-256 and sends the result in the X-Signature header. If you hash anything other than the exact raw text, the check fails.

• Your Lovable or Bolt app does not react to payments

  Apps built with tools like Lovable and Bolt often have a front end plus a few serverless functions. A webhook must point at a function. If it points at a page, the provider sees a happy reply and nothing runs.

• Your webhook answers with a 307 or 308 redirect

  A redirect says go to another address. Many webhook senders do not follow it and count it as a failed delivery. Use the final address in your provider settings.