AI app integration fix — Stripe webhook, auth, and Supabase in 5 days

5-day Stripe webhook fix schedule, day by day

The clock starts when staging access lands. Every day has a keyword-rich deliverable; nothing touches production until Day 4.

What a working Stripe webhook fix actually looks like

This is the file we ship on Day 2 for 80% of integration-fix intakes.stripe.webhooks.constructEventverifies the signature against the signing secret from the Stripe webhook signatures guide, the stripe_events lookup dedupes retries, and the lifecycle switch routes paid, failed, cancelled, and refunded events into a single sync function. The AI-generated version skips all three.

01// app/api/webhooks/stripe/route.ts02import { NextResponse } from "next/server";03import { headers } from "next/headers";04import Stripe from "stripe";05import { supabase } from "@/lib/supabase/server";06 07const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);08const SIGNING_SECRET = process.env.STRIPE_WEBHOOK_SECRET!;09 10export async function POST(req: Request) {11  const body = await req.text();12  const sig = (await headers()).get("stripe-signature");13  if (!sig) return NextResponse.json({ error: "no sig" }, { status: 400 });14 15  let event: Stripe.Event;16  try {17    event = stripe.webhooks.constructEvent(body, sig, SIGNING_SECRET);18  } catch (err) {19    return NextResponse.json({ error: "bad sig" }, { status: 400 });20  }21 22  // Idempotency: Stripe retries on 5xx; we refuse duplicates.23  const { data: seen } = await supabase24    .from("stripe_events")25    .select("id")26    .eq("id", event.id)27    .maybeSingle();28  if (seen) return NextResponse.json({ ok: true, duplicate: true });29 30  await supabase.from("stripe_events").insert({ id: event.id, type: event.type });31 32  switch (event.type) {33    case "checkout.session.completed":34    case "customer.subscription.updated":35    case "customer.subscription.deleted":36    case "invoice.payment_failed":37      await syncSubscriptionFromStripe(event);38      break;39  }40 41  return NextResponse.json({ ok: true });42}

Eight deliverables every AI app integration fix ships

• 01Stripe webhook handler — signature verify + idempotency + full subscription lifecycle
• 02Lovable/Bolt auth rewire — OAuth redirects, session refresh, password reset, email verification
• 03Supabase integration fix — RLS policies, server-side client, service-role key off the browser
• 04Staging + production environments — test keys, test events, two-user test rig
• 05Integration tests in CI — webhook replay, OAuth callback, RLS insert, error paths
• 06Custom domain cutover — DNS records, SSL, OAuth callbacks, HSTS header alignment
• 07Written runbook — rotate keys, register new webhooks, add a new plan, debug failed events
• 0830-minute handoff Loom — every moving part explained for the founder who hits the next incident

One integration fix, one fixed price, one written runbook

AI app integration fix vs hourly dev vs full rewrite

Against a $150/hour contractor or a 12-week rewrite, the 5-day AI app integration fix ships the same production-grade pattern for 1/10th the cost and 1/8th the time.

Stripe integration engineers who run this integration fix

One integration, one specialist. Pick the expert who owns your failure mode — or book the diagnostic and we will route for you.