Guide

Migrate webhook verification with fail-to-pass proof

Migrate Stripe webhook verification safely. Updrift runs fail-before / pass-after sandbox replay before opening an opt-in PR.

The silent failure mode

When signature tolerance or API version pins change, handlers can reject events without throwing a useful error. Renewals stop. Support tickets start.

Updrift treats webhook_verification_changed as a first-class drift kind, generates the migration, and replays skewed signatures in a sandbox matrix.

No PR without proved=true

Old-format traffic must still pass. Skewed new-format traffic must fail before the fix and pass after. Only then is a PR allowed, and only with org write opt-in.

Ready to see what breaks in your repo?