Does Lovable's Stripe integration use webhooks?

Not by default. Lovable's docs say the app checks payment status with Stripe directly, and subscriptions are matched by email. You can add webhooks if you need them.

Where does Lovable keep my Stripe key?

As a backend secret named STRIPE_SECRET_KEY, synced to your Supabase Edge Function secrets. Never paste it into chat.

Why do payments in my Lovable preview charge real money?

Lovable uses one Stripe key at a time. If that key is a live key, payments in preview are real. Use a test key while building.

00 / guide

Lovable + Stripe: do you need a webhook, and how to set one up

You connected Stripe in Lovable and checkout works. Now you're told you "need a webhook." Maybe, maybe not. Here is what Lovable does out of the box, and the exact steps if you add one.

01 / what CheckoutAlarm checks

What it would catch here

Once your app uses a webhook, it emails you when events stay undelivered or the endpoint is disabled. With or without webhooks, it emails you when sales stop for 48 hours and your past 14 days say at least 3 should have come in. It uses its own read-only key, not the one Lovable stores.

What it won't catch

Without webhooks, there are no deliveries to watch. It doesn't log in to your app, go through checkout, or see your Edge Function logs. It won't notice an app that takes the money but doesn't unlock the plan.

Plans

Free: 1 site, checked once a day. Pro: $19 a month, up to 3 sites checked hourly. You prove you own the site first. For Stripe we only take a restricted key with read access to Events, Webhook Endpoints and Charges. Full secret keys are refused. Compare plans

02 / what Lovable does by default

No webhooks needed

Lovable's docs say that by default your app doesn't use webhooks. It asks Stripe for the payment status directly, and matches subscriptions by email. Lovable: Stripe integration

Your key

When you connect your own Stripe account, you paste a restricted or secret key into the Connect Stripe form in chat. Lovable stores it as STRIPE_SECRET_KEY and syncs it to your Supabase Edge Function secrets. Lovable also offers built-in payments and recommends them. Lovable: connect Stripe

03 / add a webhook

Ask Lovable for a webhook function

Ask Lovable to add webhook handling. It creates an Edge Function with its own URL. Lovable's docs list the steps. Lovable: webhooks

Create the event destination in Stripe

In Stripe Workbench, create a webhook event destination pointing at that function URL. Pick only the events your app needs. Stripe: event destinations

Give Lovable the signing secret

Copy the endpoint's whsec_ signing secret. Add it when Lovable asks for it, not in a chat message. Lovable: webhooks

Test it

Pay with 4242 4242 4242 4242, any future date and any CVC, using a test key. Then check the endpoint's Event deliveries in Stripe. Stripe: test cards See also how to test a Stripe webhook.

Seeing 401?

Supabase Edge Functions check for a user token by default, and Stripe doesn't send one. Supabase: Edge Function 401 Fix: Edge Function returns 401.

04 / going live

Swap the key

Lovable uses one Stripe key at a time. With a live key, payments in preview are real. To go live, update the key to a live one. Lovable: go live

Swap the price IDs

Price IDs are different in test and live mode, so switch to the live ones. Lovable: go live

Make a live webhook too

A test-mode endpoint doesn't get live events. Create the live endpoint and use its new secret. Works in test, not live

Buy once yourself

Lovable's list ends with a real purchase to confirm it all works. Lovable: go live

05 / when checkout fails

Read both logs

Lovable points to the function logs (in Cloud view, or Edge Functions logs in Supabase) and to Stripe's Developers, Logs. Lovable: troubleshooting Then match any webhook error code to Stripe's table. Stripe: fix HTTP status codes

Customer portal

Lovable notes that the customer portal doesn't work in the preview panel and has to be turned on in Stripe first. Lovable: customer portal

Disconnecting on your own Supabase

Lovable warns that disconnecting Stripe on your own Supabase project leaves STRIPE_SECRET_KEY in place, so the app can keep charging. If you meant to stop payments, check your Supabase Edge Function secrets. Lovable: disconnect

06 / questions

Does Lovable's Stripe integration use webhooks?: Not by default. Lovable's docs say the app checks payment status with Stripe directly, and subscriptions are matched by email. You can add webhooks if you need them.
Where does Lovable keep my Stripe key?: As a backend secret named STRIPE_SECRET_KEY, synced to your Supabase Edge Function secrets. Never paste it into chat.
Why do payments in my Lovable preview charge real money?: Lovable uses one Stripe key at a time. If that key is a live key, payments in preview are real. Use a test key while building.

07 / where CheckoutAlarm fits

CheckoutAlarm emails you when Stripe sales stop, and, once you add a webhook, when its events stay undelivered or the endpoint is disabled. It reads Stripe with its own read-only key.

CheckoutAlarm is new. It only checks sites you prove you own. How to verify

Watch my app free

08 / sources

Docs checked on Oct 20, 2026.