Stripe webhook failing with 307 or 308 on Vercel

Send a POST to the exact URL Stripe has, and look at the status and where it points:

curl -s -o /dev/null -w "%{http_code} %{redirect_url}\n" \
  -X POST https://yourdomain.com/api/stripe/webhook

Your handler should answer 400 here (no signature). A 307 or 308 with a new address means something in front of your code is redirecting.

If one of your domains redirects to the other (set in the Domains settings), use the one that serves the page. Vercel: domain redirects

A rule that sends your-project.vercel.app to your custom domain answers with a redirect. Register the custom domain URL in Stripe. Vercel: choose a canonical production domain

Next.js redirects /api/webhook/ and /api/webhook to one form, based on the trailingSlash setting. Register the form your app serves. Next.js: trailingSlash

Redirects in next.config use 308 when permanent and 307 when not. Make sure no rule matches your webhook path. Next.js: redirects

Vercel turns // into one slash with a 308 before your code runs. Check the URL in Stripe for a stray extra slash. Vercel: automatic URL normalization

A protected preview may send Stripe to a login page instead of your code. For testing, Vercel's Protection Bypass for Automation can go in the URL as x-vercel-protection-bypass. Treat that URL as a secret. Your live endpoint should point at production, not a preview. Vercel: Protection Bypass for Automation

Set the endpoint URL in Stripe to the final address. Resend a failed event from Event deliveries. A good delivery shows 200. Stripe: debug webhook deliveries