From 48a53330bb33c05dc7760761d8e4f103bc02748b Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 22 Apr 2026 03:54:35 +0000 Subject: [PATCH 1/2] fix: only warn about missing STRIPE_WEBHOOK_SECRET when Stripe is configured The STRIPE_WEBHOOK_SECRET warning was emitted unconditionally at startup, even when STRIPE_SECRET_KEY itself was not set. This produced a redundant second warning alongside the existing STRIPE_SECRET_KEY warning for users who haven't configured Stripe at all. Change the independent 'if' to 'else if' so the webhook-secret warning only fires when Stripe is actually enabled (STRIPE_SECRET_KEY is present) but the webhook secret is missing. Co-authored-by: SP Digital --- server/index.js | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/server/index.js b/server/index.js index 2bfad7b3..dc03870c 100644 --- a/server/index.js +++ b/server/index.js @@ -537,8 +537,7 @@ if (!FAL_KEY) { } if (!stripe) { console.warn('⚠️ STRIPE_SECRET_KEY environment variable is not set — checkout sessions will be unavailable.'); -} -if (!stripeWebhookSecret) { +} else if (!stripeWebhookSecret) { console.warn('⚠️ STRIPE_WEBHOOK_SECRET environment variable is not set — Stripe webhooks will be unavailable.'); } From 40c85db5b16e8e9be8893ada0e3a16c309b15161 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Wed, 22 Apr 2026 03:55:19 +0000 Subject: [PATCH 2/2] fix: downgrade missing STRIPE_WEBHOOK_SECRET to info-level message MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Webhooks are an optional safety net — the client-side /api/verify-checkout-session endpoint already handles purchase reconciliation for the normal flow. A missing webhook secret is a deliberate configuration choice, not an error, so demote the log from console.warn to console.info and clarify that purchases still work without it. Co-authored-by: SP Digital --- server/index.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/server/index.js b/server/index.js index dc03870c..6c73a04f 100644 --- a/server/index.js +++ b/server/index.js @@ -538,7 +538,7 @@ if (!FAL_KEY) { if (!stripe) { console.warn('⚠️ STRIPE_SECRET_KEY environment variable is not set — checkout sessions will be unavailable.'); } else if (!stripeWebhookSecret) { - console.warn('⚠️ STRIPE_WEBHOOK_SECRET environment variable is not set — Stripe webhooks will be unavailable.'); + console.info('ℹ️ STRIPE_WEBHOOK_SECRET is not set — webhook delivery is disabled. Purchases are still verified via /api/verify-checkout-session.'); } const { adminAuth, adminDb } = createFirebaseAdminServices({