Lemon Squeezy webhook test checklist
Before checkout goes live, SaaS billing routes need a compact checklist that catches signature, contract, idempotency, and entitlement mistakes.
Open the free generatorVerify exact raw bodies
Compute the HMAC from the exact raw request bytes before parsing JSON. Do not verify a parsed and reserialized payload.
Lock trusted fields
Assert event name, object type, object ID, payment or subscription status, customer mapping, currency, amount, and the idempotency key source.
Replay duplicate deliveries
Send the same signed fixture three times and assert that access grants, emails, and billing mutations happen once.
Map entitlement decisions
Define what paid orders, subscription creations, renewals, cancellations, failed payments, licenses, and unknown events are allowed to do.
FAQ
Can this checklist run without paid APIs?
Yes. Most checks run with local fake fixtures, fake signing secrets, and CI tests before any live provider delivery.
What is the highest-risk Lemon Squeezy webhook bug?
Processing a valid provider event more than once is a common failure because retries can duplicate access, emails, or billing records.
Use the free sample before wiring production checkout
Download a public sample pack with fake Lemon Squeezy fixtures, signature tests, contract checks, duplicate replay tests, and CI skeletons. The Pro Kit preview shows the full paid package structure without exposing the private archive.