# CheckoutAlarm

> CheckoutAlarm checks that a small web app (for example one built with Lovable, Bolt, Cursor or Supabase) is still up and that its Stripe account is still receiving payments and delivering webhooks, and emails the owner when something breaks. Made by Volado Labs. Status: live at checkoutalarm.com; sign-ups are open (free plan for 1 site, Pro $19/month for up to 3 sites).

## Site ownership first
- No check runs until the owner proves they own the site, using any one of: a DNS TXT record at _checkoutalarm.<host>, a <meta name="checkoutalarm-verification"> tag on the home page, or a file at /.well-known/checkoutalarm-verification.txt.
- Ownership is re-checked once a day. If the proof is missing on 2 checks in a row, monitoring pauses and the owner gets one email. The daily re-check keeps running on paused sites, and monitoring resumes on its own (with one "checks are back on" email) when the proof is back.
- Requests identify as CheckoutAlarmBot/1.0 (+https://checkoutalarm.com/bot). Hosts that resolve to private network addresses are refused.

## Page checks
- A scheduled HTTP GET of one page the owner picks. It fails on an error status, no response, or a missing expected title or phrase. Slow responses are noted.
- One failure is not an alert. An alert goes out after 2 failures in a row, and a recovery notice when the page passes again.

## Stripe health (read-only)
- Uses a Stripe restricted key only (rk_live_ or rk_test_). Full secret keys (sk_) are refused. Needed read permissions: Events, Webhook Endpoints, Charges.
- Alerts on: events still not delivered to a webhook endpoint after a grace period, webhook endpoints with status "disabled", and stalled sales (no successful charges in a 48-hour window when the previous 14 days predict some). It does not alert when an account has no webhook endpoints at all.
- Keys are stored encrypted. Alerts are email only.
- Check history and alerts are kept 90 days. Deleting a site deletes its history; deleting the account deletes everything, including the stored Stripe key.

## Plans
- Free: 1 site; page check and Stripe health once a day; email alerts.
- Pro: $19/month, paid up front through Stripe; up to 3 sites checked hourly; Stripe health hourly.
- Cancel Pro any time: it runs to the end of the paid month, then the account moves to Free and keeps the oldest verified site (other sites are paused, not deleted).
- Refunds: email hello@checkoutalarm.com within 7 days of a charge for a full refund.
- Billing is managed in the Stripe customer portal, opened from the account's manage page.

## Account
- No passwords: after signup the owner gets a private manage link by email (it works like a password). One account per email address.
- Deleting the account cancels its Stripe subscriptions first, then deletes sites, check history, alerts and the stored Stripe key.

## What it does not check
- It does not run a browser, fill in forms, start a checkout or press Pay. It loads one page and reads Stripe with a read-only restricted key.

## Pages
- [Home](https://checkoutalarm.com/): what we check, ownership verification, FAQ
- [Pricing](https://checkoutalarm.com/pricing)
- [Guide: Stripe webhook not firing, 7 causes and how to check](https://checkoutalarm.com/guides/stripe-webhook-not-firing)
- [Guide: verify that you own your site (DNS record, meta tag or file)](https://checkoutalarm.com/guides/verify-your-site)
- [Guide: Supabase Edge Function returns 401 to Stripe webhooks and the function logs are empty (platform verify_jwt check runs before your code; how to confirm in Invocations and the response body; --no-verify-jwt; new sb_publishable_/sb_secret_ keys; also 401s from Vercel Deployment Protection or a Next.js auth proxy)](https://checkoutalarm.com/guides/supabase-edge-function-stripe-webhook-401)
- [Guide: Stripe webhook signature verification failed in Next.js (raw body, secret, header)](https://checkoutalarm.com/guides/stripe-webhook-signature-verification-failed-nextjs)
- [Guide: Stripe webhook failing with 307 or 308 redirects on Vercel](https://checkoutalarm.com/guides/stripe-webhook-307-308-redirect-vercel)
- [Guide: why uptime checks pass while checkout or Stripe webhooks break (UptimeRobot, Better Stack, Pingdom, Checkly, Hookdeck facts checked Oct 19, 2026)](https://checkoutalarm.com/guides/uptime-check-passes-checkout-broken)
- [Guide: Supabase confirmation or magic-link email not arriving (Lovable, Bolt): built-in email limits, "email rate limit exceeded" (over_email_send_rate_limit, 429), custom SMTP such as Resend, redirect URLs, spam](https://checkoutalarm.com/guides/supabase-confirmation-email-not-arriving)
- [Guide: Stripe Checkout success URL not working ({CHECKOUT_SESSION_ID}, fulfill from the webhook)](https://checkoutalarm.com/guides/stripe-checkout-success-url-not-working)
- [Guide: missed Stripe webhooks, how to find and replay undelivered events (delivery_success=false, retry schedule, how to stop retries, resend limits, duplicate-safe processing)](https://checkoutalarm.com/guides/stripe-missed-webhook-events)
- [Guide: customer paid but premium didn't unlock: a failed webhook delivery (CheckoutAlarm catches this) vs a handler that returns 200 and saves nothing (CheckoutAlarm does not catch this)](https://checkoutalarm.com/guides/stripe-paid-but-not-unlocked)
- [Guide: Stripe webhook 400, 500 or timed out: what each status means and how to answer fast (return 2xx first, after(), EdgeRuntime.waitUntil, queue)](https://checkoutalarm.com/guides/stripe-webhook-400-500-timeout-errors)
- [Guide: Stripe webhook endpoint disabled: events sent while disabled are not resent; turn it back on and process missed events (CheckoutAlarm alerts on disabled endpoints)](https://checkoutalarm.com/guides/stripe-webhook-endpoint-disabled)
- [Guide: Stripe webhook works in test mode but not live (separate live endpoint, live whsec_ secret, live keys and price IDs, HTTPS)](https://checkoutalarm.com/guides/stripe-webhook-works-in-test-mode-not-live)
- [Guide: how to test a Stripe webhook (Stripe CLI listen and trigger, test cards, Event deliveries, one real purchase)](https://checkoutalarm.com/guides/how-to-test-stripe-webhook)
- [Guide: Supabase magic link or confirmation email redirects to localhost (Site URL, Redirect URLs allow list, emailRedirectTo, RedirectTo template)](https://checkoutalarm.com/guides/supabase-magic-link-redirects-to-localhost)
- [Guide: Supabase sign-up emails sent with Resend going to spam (SPF, DKIM, DMARC, custom domain, plain auth emails)](https://checkoutalarm.com/guides/supabase-resend-emails-going-to-spam)
- [Guide: Lovable + Stripe: no webhooks by default; how to add one, go live and debug checkout](https://checkoutalarm.com/guides/lovable-stripe-webhook-setup)
- [Guide: Bolt + Stripe + Supabase: requirements, what Bolt builds (checkout, webhook and subscription functions), testing and going live](https://checkoutalarm.com/guides/bolt-stripe-supabase-integration)
- [Guide: Stripe customer subscribed twice: find and stop duplicate subscriptions (limit to one subscription, reuse the Customer, idempotency keys; CheckoutAlarm does not catch this)](https://checkoutalarm.com/guides/stripe-duplicate-subscriptions)
- [Free tools index: Stripe webhook tools that run in the browser](https://checkoutalarm.com/tools)
- [Tool: Stripe webhook signature checker (paste raw body, Stripe-Signature header and whsec_ secret; HMAC-SHA256 computed in the browser, nothing sent; flags changed bodies, wrong or padded secrets, old timestamps)](https://checkoutalarm.com/tools/stripe-webhook-signature-checker)
- [Tool: Stripe webhook error decoder (paste an error or Event deliveries status: signature failed, parsed body, 3xx redirect, 401/403, 404/405, 500, timeout, TLS, unable to connect, disabled endpoint, test vs live mode; explanation, fix and guide link)](https://checkoutalarm.com/tools/stripe-webhook-error-decoder)
- [Tool: webhook outage cost calculator (revenue at risk while a Stripe webhook was broken, which events Stripe still retries within 3 days, plus a "did my sales stall?" Poisson check)](https://checkoutalarm.com/tools/webhook-outage-cost-calculator)
- [About CheckoutAlarmBot](https://checkoutalarm.com/bot)
- [Privacy](https://checkoutalarm.com/privacy)
- [Terms](https://checkoutalarm.com/terms)

## Contact
- Support and questions: hello@checkoutalarm.com