Lemon Squeezy webhooks notify your application about order completions, subscription changes, license key events, and refunds. They power the server-side of SaaS billing built on Lemon Squeezy's platform.
Lemon Squeezy webhooks are HTTP POST requests that Lemon Squeezy sends to your server when specific events occur in your account. Rather than continuously polling the Lemon Squeezy API for updates, webhooks deliver real-time notifications the moment something happens — a payment completes, a user signs up, a deployment finishes, or any other tracked event.
Debugging these webhooks can be challenging because they originate from Lemon Squeezy's servers, not your browser. You can't simply open DevTools to inspect them. That's where WebhookVault comes in — capture every Lemon Squeezy webhook, inspect the full payload and headers, and replay them to your local development server.
| Event | Description |
|---|---|
| order_created | Fired when a customer completes a purchase |
| subscription_created | Fired when a new subscription is started |
| subscription_payment_success | Fired when a recurring subscription payment succeeds |
| license_key_created | Fired when a new license key is generated |
Follow these steps to start capturing and debugging Lemon Squeezy webhooks using WebhookVault.
Sign up for a free WebhookVault API key and create an endpoint to capture Lemon Squeezy webhooks.
curl -X POST https://webhookvault.anethoth.com/api/v1/endpoints \
-H "Authorization: Bearer wv_your_key" \
-H "Content-Type: application/json" \
-d '{"name": "Lemon Squeezy Webhooks"}'
# Response:
# {"url": "https://webhookvault.anethoth.com/hook/abc123", "inspect_url": "https://webhookvault.anethoth.com/inspect/abc123"}Go to your Lemon Squeezy Dashboard > Settings > Webhooks Click 'Add Webhook' and enter your WebhookVault endpoint URL Select the events you want to receive (order_created, subscription_created, etc.) Save and copy the signing secret for webhook verification
Once Lemon Squeezy sends a webhook, you can inspect every detail through the WebhookVault API or web inspector.
curl https://webhookvault.anethoth.com/api/v1/endpoints/abc123/requests \
-H "Authorization: Bearer wv_your_key"
# Returns all captured Lemon Squeezy webhook requests with full headers, body, and metadataReplay any captured Lemon Squeezy webhook to your local development server for testing.
curl -X POST https://webhookvault.anethoth.com/api/v1/endpoints/abc123/requests/1/replay \
-H "Authorization: Bearer wv_your_key" \
-H "Content-Type: application/json" \
-d '{"url": "http://localhost:3000/webhook"}'
# The original Lemon Squeezy webhook is replayed to your local serverHere is an example of a typical Lemon Squeezy webhook payload. Use WebhookVault to capture real payloads from your Lemon Squeezy account for accurate testing.
{
"meta": {
"event_name": "order_created",
"webhook_id": "wh_abc123"
},
"data": {
"type": "orders",
"id": "1",
"attributes": {
"store_id": 1,
"identifier": "order_abc123",
"order_number": 1001,
"status": "paid",
"total": 999,
"total_formatted": "$9.99",
"currency": "USD",
"user_email": "[email protected]",
"created_at": "2024-01-15T10:30:00.000000Z"
}
}
}Here are the most common issues developers encounter when working with Lemon Squeezy webhooks, and how to resolve them.
Lemon Squeezy signs webhooks with HMAC-SHA256 using your signing secret. Verify the X-Signature header against the raw request body.
Lemon Squeezy has separate test and live modes. Ensure your webhook URL is configured in the correct mode.
Lemon Squeezy retries failed webhooks up to 5 times with exponential backoff. Return a 2xx response to acknowledge receipt.
Lemon Squeezy uses the JSON:API specification. Data is nested under data.attributes, not at the top level.
Lemon Squeezy webhooks are HTTP callbacks that Lemon Squeezy sends to your server when specific events occur. Instead of polling the Lemon Squeezy API for changes, webhooks push real-time notifications to your application, making your integration more efficient and responsive.
Use WebhookVault to capture Lemon Squeezy webhooks in the cloud, then replay them to your localhost. Create a WebhookVault endpoint, configure Lemon Squeezy to send webhooks to it, and use the replay API to forward captured requests to http://localhost:3000/webhook (or your local port).
Most webhook providers, including Lemon Squeezy, sign their webhook payloads to prove authenticity. Check the Lemon Squeezy documentation for the specific signature header and verification algorithm. Use WebhookVault to capture and inspect the raw headers to debug signature verification issues.
Unlike ngrok, WebhookVault captures and stores every webhook request with full headers and payloads. You can replay any Lemon Squeezy webhook to your local server as many times as needed, inspect historical requests, and share webhook data with your team. No tunnel to maintain or port to expose.
Create a free WebhookVault endpoint in seconds. Capture, inspect, and replay Lemon Squeezy webhooks with zero configuration.
Get Free API Key