Cloudflare Worker webhook handler
Workers are a good zero-cost starting point for small webhook endpoints when the handler is strict and fast.
Open the free generatorUse Web Crypto
Compute HMAC SHA-256 with crypto.subtle and compare the resulting hex digest with the provider signature header.
Keep secrets in bindings
Store webhook secrets in Worker environment bindings, never in client-side code or committed files.
Return fast
Verify, record, and acknowledge the event quickly; defer slow entitlement syncing to a queue or durable job when needed.
FAQ
Can Workers verify Lemon Squeezy webhooks?
Yes. Web Crypto can compute the HMAC digest needed for signature verification.
Is a Worker required for BillingWebhookKit?
No. The free generator is browser-only; Workers are one deployment option for your own app.
Use the free sample before wiring production checkout
Download a public sample pack with fake Lemon Squeezy fixtures, signature tests, contract checks, duplicate replay tests, and CI skeletons. The Pro Kit preview shows the full paid package structure without exposing the private archive.