Lovable app: Stripe payment succeeded but nothing happens

Your customer paid. Stripe shows the charge, they got the receipt email, the money is on its way to your bank. But your app didn't react: no unlocked content, no order created, no plan upgrade. From the customer's side, it looks like you took their money and gave them nothing.

If your app was built with Lovable — or any AI builder on the Supabase + Stripe stack — this is the single most common payment bug, and it has one root cause far more often than any other.

The root cause: your app never hears about the payment

Stripe Checkout runs on Stripe's servers, not yours. When a customer pays, the payment succeeds inside Stripe. Your app finds out exactly one way: Stripe calls a URL on your backend — a webhook — and your code updates the database. No webhook, no update. The payment is real, and your app is deaf to it.

Lovable is genuinely good at generating the visible half: the pricing page, the checkout button, the redirect to Stripe. The invisible half — registering a webhook endpoint, verifying its signature, writing the result into Supabase — is where generated code most often stops short, half-finishes, or works in preview and dies in production.

Check 1: confirm the payment is real (1 minute)

In the Stripe Dashboard, open Payments. Find your customer's charge and confirm it shows Succeeded. If it's there, everything below applies. If it isn't, your problem is in checkout itself, not the webhook — the dead buy button guide covers that path.

Check 2: does a webhook endpoint exist at all? (2 minutes)

Open the Developers area (bottom-left of the Dashboard — Stripe now calls it Workbench) and select the Webhooks tab. You're looking for an endpoint whose URL points at your app's backend. For Lovable apps that's usually a Supabase Edge Function:

https://YOUR-PROJECT-REF.functions.supabase.co/stripe-webhook

If the list is empty, you've found the root cause: Stripe has nowhere to send the news. Nothing in your app's code can matter until an endpoint exists here.

Check 3: the endpoint exists — is it failing? (5 minutes)

Click the endpoint and look at its recent event deliveries. Every delivery shows the HTTP response your server gave. Three codes cover most Lovable cases:

• 401 Unauthorized — the classic Supabase one. Edge Functions require a Supabase login token (JWT) by default, and Stripe doesn't have one, so Supabase rejects the call before your code even runs.
• 400 Bad Request — usually signature verification failing: the whsec_... secret your function holds doesn't match this endpoint (each endpoint has its own).
• 500 / no response — the function crashed. Open Supabase → Edge Functions → your function → Logs, and read the last error.

The 401 has a clean, safe fix: tell Supabase that this one function should skip login checks — Stripe proves itself with its signature instead. In your project's supabase/config.toml:

[functions.stripe-webhook]
verify_jwt = false

…then redeploy the function. The same setting exists as a toggle in the Supabase dashboard under the function's details. After changing it, hit Resend on a failed event in Stripe and watch the response code change.

Check 4: did the database actually update?

A 200 response is not the finish line. Open Supabase → Table Editor and look at the table your app checks for access — profiles, subscriptions, orders, names vary. Find the paying customer's row and see whether anything changed at the time of the payment. Delivered-but-never-written is its own failure mode, covered in the locked-out customers guide.

If the checks found it — and if they didn't

If your webhook list was empty, or a 401 was blocking everything, the checks above may genuinely be all you needed. Resend the failed events, watch them go green, and manually unlock anyone who paid during the outage — Stripe keeps every missed event, so nothing is lost.

If the endpoint exists, returns 200, and the database still doesn't move — or you're not comfortable redeploying functions on a live app — that's the harder version of this bug, and it's exactly the kind we take.