The latest articles on DEV Community by noor abid (@noor_abid_ed5b15458af2400). https://dev.to/noor_abid_ed5b15458af2400 https://media2.dev.to/dynamic/image/width=90,height=90,fit=cover,gravity=auto,format=auto/https:%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Fuser%2Fprofile_image%2F4109801%2Fe0e4bc62-d38b-43ac-b503-a242f2329472.png https://dev.to/noor_abid_ed5b15458af2400 en noor abid Mon, 07 Sep 2026 21:34:19 +0000 https://dev.to/noor_abid_ed5b15458af2400/my-payment-webhook-returned-200-and-still-didnt-upgrade-a-single-user-1jbn https://dev.to/noor_abid_ed5b15458af2400/my-payment-webhook-returned-200-and-still-didnt-upgrade-a-single-user-1jbn <p>For two weeks, Ember's upgrade-to-Pro flow looked fine and was completely broken. Every webhook call from Gumroad came back 200, no errors anywhere — and not one real purchase actually flipped a user to Pro.</p> <p>I'd built it assuming Gumroad signs and nests its payloads the way Stripe does. It doesn't — no signature header at all, and the fields (email, seller_id, product_id) come through flat and form-encoded, not tucked in a purchase object. My code was reading a shape that never existed, so every lookup silently failed while the handler kept reporting success.</p> <p>Fixed it with my own token check on the webhook URL instead of a signature, and by parsing the real flat payload. Found one more sharp edge along the way: a Supabase update that matches zero rows fails silently too — so a mismatched email could still report "success" and update nothing.</p> <p>Lesson: 200 OK means your code didn't crash. It says nothing about whether it did what it was supposed to.</p> webdev beginners testing startup