BillingWebhookKit

Cloudflare Worker webhook handler

Workers are a good zero-cost starting point for small webhook endpoints when the handler is strict and fast.

Open the free generator

Use Web Crypto

Compute HMAC SHA-256 with crypto.subtle and compare the resulting hex digest with the provider signature header.

Keep secrets in bindings

Store webhook secrets in Worker environment bindings, never in client-side code or committed files.

Return fast

Verify, record, and acknowledge the event quickly; defer slow entitlement syncing to a queue or durable job when needed.

FAQ

Can Workers verify Lemon Squeezy webhooks?

Yes. Web Crypto can compute the HMAC digest needed for signature verification.

Is a Worker required for BillingWebhookKit?

No. The free generator is browser-only; Workers are one deployment option for your own app.

Use the free sample before wiring production checkout

Download a public sample pack with fake Lemon Squeezy fixtures, signature tests, contract checks, duplicate replay tests, and CI skeletons. The Pro Kit preview shows the full paid package structure without exposing the private archive.