Without the webhook, Traaaction never hears about your sales — no commissions, no clawbacks, nothing. Setup takes 5 minutes.
1. Get your endpoint URL
- In Traaaction: Dashboard → Developer → Webhooks.
- Copy the endpoint URL (one per workspace). It looks like:
https://www.traaaction.com/api/webhooks/{endpointId}
Also copy the signing secret shown below it — you'll paste it into Stripe.
2. Add it in Stripe
- In Stripe: Developers → Webhooks → Add endpoint.
- Paste the Traaaction endpoint URL.
- Select these four events:
| Event | What it does |
|---|---|
checkout.session.completed | Creates the first commission (SALE, or RECURRING month 1). |
invoice.paid | Creates recurring commissions for months 2+. |
charge.refunded | Clawback — deletes or reverses the commission. |
customer.subscription.deleted | Removes pending commissions on cancellation. |
- Important: Stripe shows you its own signing secret (
whsec_...). Copy it back into Traaaction so we can verify signatures.
3. Pass the click ID in Checkout
Every Checkout session must carry tracClickId in metadata. Without it, Traaaction can't attribute the sale.
const session = await stripe.checkout.sessions.create({
mode: "subscription",
line_items: [...],
success_url: "...",
metadata: {
tracClickId: cookies.get("trac_click_id"),
},
})
Our SDKs (traaaction on npm and PyPI) ship a getClickId(request) helper that reads the cookie for you — see SDKs and REST API.
4. Verify it works
- In Stripe: fire a test event from the webhook page. You should see
200 OK. - In Traaaction: the commission shows up in Dashboard → Commissions within 1–2 seconds.
- No commission? Check the event log in Dashboard → Developer → Webhooks → Logs. Missing
tracClickId, invalid signature, or a zero/negative amount will show as "skipped" with a reason.
Security
Every event is verified with your Stripe signing secret via HMAC. Anything that fails verification is dropped. Secrets are stored encrypted and are workspace-scoped, so a leak in one workspace can't affect another.
Related
- How tracking works — where the
trac_click_idcookie comes from - Commission lifecycle — what happens after the webhook fires
- Troubleshooting attribution — commission didn't show up?