Create the Stripe webhook that pushes payment events back into your Salesforce org for a Stripe Direct account, set up a matching test webhook, and collect the signing secret and API keys.
This guide walks you through connecting your own Stripe account to your Salesforce org using a webhook.A few terms before you start:
Stripe is the payment processor that actually charges the card.
Salesforce is the system that fusionCore runs inside.
A webhook is a URL that Stripe calls to push events back into your org — for example, when a payment succeeds, fails, or is refunded. Without it, your fusionCore records will not stay in sync with what happens in Stripe.
A Stripe Direct account is your own standalone Stripe account connected straight to fusionCore, rather than a connected account routed through the fusionSpan platform account.
This page covers the Stripe-side webhook setup for a Stripe Direct account. For the in-org configuration that precedes it — the Payment Provider Account record, the Stripe_MDT_Prefix__c value, and the Payment Provider Secret records — see Stripe Direct Accounts.
Log into your Stripe account on the Stripe website.Confirm you are in the correct account — the account name appears in the top left. Setting the webhook on the wrong account is a common cause of payment modals that hang on loading.
2
Open the Webhooks area
Click Developers, then click Webhooks.
Developers menu in Stripe
Webhooks area in Stripe
3
Create the event destination
Click Create an event destination.
Create an event destination in Stripe
4
Add the events fusionCore handles
Click the All events tab and add the following 15 events. You can paste each name into the search bar to find it quickly.
charge.refund.updated
payment_intent.canceled
payment_intent.payment_failed
payment_intent.processing
payment_intent.requires_action
payment_intent.succeeded
customer.created
customer.updated
setup_intent.canceled
setup_intent.requires_action
setup_intent.setup_failed
setup_intent.succeeded
payment_method.updated
payment_method.automatically_updated
payment_method.detached
Copy each name directly from this list and paste it into the Stripe search bar.
If you see 16 events after saving 15, this is normal. Stripe automatically adds payment_method.card_automatically_updated alongside payment_method.automatically_updated. It will not affect your integration.
Subscribe to only these events. fusionCore’s webhook endpoint rejects event types it does not handle, which adds noise to the Stripe_API_Log__c records and makes real failures harder to spot.
Selecting the events fusionCore handles
5
Choose the destination type
Click Continue, select Webhook endpoint as your destination type, then click Continue again.
Choosing the destination type in Stripe
6
Build the endpoint URL
Your endpoint URL is your Salesforce Site URL with the fusionCore webhook path added to the end.
Take your Site URL, which is in the format [yourURL].my.salesforce-sites.com.
Add /services/apexrest/FCORE_PSTRIPE/Stripe to the end of it.
The final URL resembles business-fun-2656.my.salesforce-sites.com/services/apexrest/FCORE_PSTRIPE/Stripe.
Check the URL carefully. Extra slashes (/), extra spaces, or misspellings will cause the webhook to fail.
Paste the final URL into a plain notepad first to verify it before entering it as the endpoint URL.
Building the endpoint URL in Stripe
7
Create the destination
Click Create destination at the bottom left. Your webhook is now created.
Alongside your live webhook, set up a test webhook so you can verify the Stripe connection before taking real payments.Set up one test webhook for each Salesforce environment you run fusionCore in. For example, with three environments — Production, Partial sandbox, and Full sandbox — you set up three Stripe test webhooks.The steps are identical to the live webhook above, with one difference: you create each test webhook inside a Stripe sandbox rather than on your live account. Open a sandbox by clicking your Stripe account name in the top left and selecting the sandbox you want.
Stripe sandbox switcher
If you do not have a sandbox yet, follow Stripe’s create a sandbox instructions, then repeat the live webhook steps inside it.
fusionSpan needs your signing secret and API keys to finish the webhook setup. These are sensitive credentials, so handle and transfer them only through a secure channel.
The signing secret proves that events reaching your webhook genuinely come from Stripe and not from a malicious sender.
The API keys let Stripe authenticate fusionCore’s requests.
1
Copy the signing secret
Go to Developers → Webhooks → [your webhook].Click the eye icon to reveal the signing secret, then click the clipboard icon to copy it.
Revealing the signing secret in Stripe
2
Copy the API keys
Go to Developers → Overview (bottom left) and scroll to the API keys section.Copy the Publishable key (starts with pk) and the Secret key (starts with sk).
API keys section in Stripe
Send the signing secret and API keys to the fusionSpan team through a secure channel, and label each one clearly by environment. This includes the test webhook signing secrets and API keys, so they can be told apart from the live ones.
Make sure every payment method you want to accept is enabled on your Stripe account.
1
Open payment method settings
Log into Stripe, then go to Settings → Payments → Payment methods.
Payment methods settings in Stripe
2
Enable the methods you want
Click Default, then under Default click Enable for each payment method you want to offer.Stripe Direct accounts support Card, ACH, WeChat Pay, and Alipay.
Validate the Payment Provider Account after the webhook exists. Validation completes in two stages. Clicking Validate on the Payment Provider Account record does not by itself mark it Succeeded; it sets up a Stripe test customer and then waits for the inbound customer.created or customer.updated webhook event to flip FCORE_PAY__Validation_Status__c to Succeeded. If the webhook is missing or misconfigured, validation never completes even when your keys are correct.
Editing key fields silently resets validation. Changing FCORE_PAY__External_Id__c, FCORE_PAY__Request_Signature_Secret__c, or Stripe_MDT_Prefix__c on the Payment Provider Account clears FCORE_PAY__Validation_Status__c. You must re-run Validate afterward.
Failed webhook events fail quietly. fusionCore rejects an inbound request — returning an HTTP 204 that Stripe treats as success and does not retry — when the Stripe-Signature header is missing or invalid, the signature does not match your signing secret, or the request is older than 300 seconds. Events meant for a different org or for the wrong live/test mode are also dropped silently. Because Stripe sees a success, these failures are easy to miss; if records stop syncing, check that the signing secret and endpoint URL exactly match.
Use exactly the listed endpoint path and event set. A typo, extra slash, or extra space in /services/apexrest/FCORE_PSTRIPE/Stripe breaks the webhook. Subscribing to events outside the 15 listed above causes the endpoint to error on those events.
Pending payments can auto-cancel. Payments left awaiting member action are cancelled after method-specific timeouts: 60 minutes for Card, 7 days for ACH, and 5 minutes for Alipay and WeChat Pay. A member who delays completing 3-D Secure or microdeposit verification past these windows will have the payment cancelled.
⌘I
Assistant
Responses are generated using AI and may contain mistakes.
