Which card number do I use?

In a sandbox with test keys, use 4242 4242 4242 4242 with any future date and any CVC. Stripe's card 4000 0000 0000 0002 tests a decline.

Does stripe trigger make real objects?

In your sandbox, yes. Stripe says triggering an event creates real API objects as a side effect and may set off other events.

Is the stripe listen secret the same as my dashboard secret?

No. stripe listen prints its own signing secret. Use it only for local testing.

00 / guide

How to test a Stripe webhook (locally and on your live site)

Before real customers pay, check that a payment actually reaches your app. There are three levels: on your computer, on your deployed site with a test card, and one real purchase after launch.

Free tool: check a webhook signature in the browser

01 / what CheckoutAlarm checks

What it would catch here

After launch, it watches the result of your setup: live events that stay undelivered, disabled endpoints, and sales that stop. It is a check that keeps running after your tests are done.

What it won't catch

It doesn't run tests for you. It has no browser, doesn't go through checkout, and doesn't send events to your webhook. There is no CheckoutAlarm command-line tool. The tools below are Stripe's own.

Plans

Free: 1 site, checked once a day. Pro: $19 a month, up to 3 sites checked hourly. You prove you own the site first. For Stripe we only take a restricted key with read access to Events, Webhook Endpoints and Charges. Full secret keys are refused. Compare plans

02 / on your computer

Install the Stripe CLI and log in

The Stripe CLI is Stripe's own tool. Install it, then run stripe login. Stripe: test your webhook locally

Forward events to your app

Run stripe listen --forward-to localhost:4242/webhook, using your own port and path. It prints a signing secret. Put that in your local settings, not production. Stripe: stripe listen

Send a test event

In a second window, run stripe trigger payment_intent.succeeded. Your app should log it and answer 200. This creates real objects in your sandbox and can set off other events too. Stripe CLI: trigger

03 / on your deployed site

Use test keys and a test endpoint

Point a sandbox endpoint at your deployed URL and use that endpoint's whsec_ secret. Stripe also lets you send test events with sandbox actions. Stripe: test a webhook or event destination

Pay with a test card

Go through your real checkout with 4242 4242 4242 4242, any future date and any CVC. Then try 4000 0000 0000 0002 to see a decline. Stripe: test cards

Check both sides

In Workbench, open the endpoint's Event deliveries and confirm each event says Delivered. Stripe: event deliveries Then check your app: is the user marked as paid? A 200 alone doesn't prove your code did its job.

Subscriptions

Stripe's subscription docs list ways to test renewals and failed payments. Stripe: test subscription webhooks

04 / after launch

Make one real purchase

Switch to live keys, the live endpoint and its live secret. Buy your cheapest plan once. See works in test, not live.

Resend one event

You can resend an event from the dashboard for 15 days, or with stripe events resend for 30 days. Stripe: manually resend events

05 / questions

Which card number do I use?: In a sandbox with test keys, use 4242 4242 4242 4242 with any future date and any CVC. Stripe's card 4000 0000 0000 0002 tests a decline.
Does stripe trigger make real objects?: In your sandbox, yes. Stripe says triggering an event creates real API objects as a side effect and may set off other events.
Is the stripe listen secret the same as my dashboard secret?: No. stripe listen prints its own signing secret. Use it only for local testing.

06 / where CheckoutAlarm fits

CheckoutAlarm keeps watching after your tests pass. It emails you when live events stay undelivered, an endpoint is disabled, or sales stop. It doesn't run test payments.

CheckoutAlarm is new. It only checks sites you prove you own. How to verify

Watch my app free

07 / sources

Docs checked on Oct 20, 2026.