Skip to main content
This page is for the fusionCore implementation team. Use it after a client has their own Stripe account and is ready to connect it to their Salesforce org. A webhook is a URL that Stripe calls to push events back into the org. When a payment succeeds, fails, or is refunded, Stripe sends an event to that URL so fusionCore can keep order and payment records accurate. A signing secret is a value Stripe generates for each webhook. fusionCore uses it to verify that an inbound request really came from Stripe. You store this secret on the client’s Payment Provider Account — the fusionCore record (FCORE_PAY__Payment_Provider_Account__c) that holds the Stripe connection settings — in the Request Signature Secret field (FCORE_PAY__Request_Signature_Secret__c). The client creates the webhook from their side, then hands you the signing secret for each one so you can finish configuring the Payment Provider Account.

​
Prerequisites

  • The client has a Stripe account that is connected to fusionCore.
  • The client can sign in to that Stripe account and reach Developers → Webhooks.

​
Set Up a Client’s Stripe Webhook

1

Send the client the webhook guide

Send the client the Stripe webhook setup guide. It walks them through creating both a live webhook and a test webhook from their Stripe account.
2

Collect each signing secret

Once the client finishes, ask them for the signing secret of every webhook they created — both the test and the live webhook. The client guide explains where to find it (live webhook setup, step 12).
3

Store the signing secrets securely

Store and transfer each signing secret through a secure channel. Label one entry per signing secret so they are not mixed up when you configure Payment Provider Accounts. Clients typically have a separate signing secret for each Salesforce environment — for example, Production, Partial Sandbox, and Full Sandbox.
Once you have the signing secrets, paste each one into the Request Signature Secret field (FCORE_PAY__Request_Signature_Secret__c) on the matching Payment Provider Account, then run Validate. See Connected Account Webhook Set Up for the validation steps.

​
Limitations and Common Pitfalls

Each Salesforce environment needs its own webhook and its own signing secret. Never reuse a webhook endpoint or signing secret across environments — for example, do not point a sandbox at the production webhook. Match each signing secret to the Payment Provider Account in the same environment.
Editing the External Id (FCORE_PAY__External_Id__c), Request Signature Secret (FCORE_PAY__Request_Signature_Secret__c), or Stripe MDT Prefix (FCORE_PSTRIPE__Stripe_MDT_Prefix__c) on a Payment Provider Account clears its Validation Status (FCORE_PAY__Validation_Status__c). After you paste in a new signing secret, you must run Validate again.
Validation does not complete from the click alone. Validate sets up a test customer in Stripe, then waits for Stripe to call the webhook back before Validation Status flips to Succeeded. If the signing secret is wrong or the webhook is misconfigured, validation never completes even when the API keys are correct.

Client-facing webhook setup guide

The shareable guide that walks a client through creating their test and live webhooks.

Connected account webhook setup

Paste each signing secret into the Payment Provider Account and run Validate.

Stripe testing — production and sandbox

Why each environment needs its own webhook and signing secret.

Stripe

How the webhook fits into the end-to-end Stripe connection.