Files
Lawrence Hook 3b1789e89e Gate Stripe webhook on STRIPE_ALLOWED_PRODUCT_IDS allowlist
Prevents foreign Stripe events (from other apps sharing this Stripe
account) from being processed. Webhook ignores events whose products
are not in the allowlist; server refuses to boot without it set.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-22 19:07:44 -04:00

23 lines
639 B
Bash

# Server
PORT=3000
BASE_URL=https://yourserver.com
# JWT
JWT_SECRET=your-random-secret-here-min-32-chars
# Stripe
STRIPE_SECRET_KEY=sk_test_...
STRIPE_PRICE_MONTHLY=price_...
STRIPE_PRICE_YEARLY=price_...
STRIPE_WEBHOOK_SECRET=whsec_...
# Comma-separated product IDs this server is allowed to act on. Webhook events
# whose products are not in this list are ignored (guards against cross-product
# event bleed when multiple apps share a Stripe account).
STRIPE_ALLOWED_PRODUCT_IDS=prod_...,prod_...
# AWS SES
AWS_REGION=us-east-1
AWS_ACCESS_KEY_ID=your-access-key
AWS_SECRET_ACCESS_KEY=your-secret-key
EMAIL_FROM=noreply@yourdomain.com