DROPWATCH NOTES · DEVELOPER EXERIMENT · SEPTEMBER 10, 2026

Your payment webhook arrives twice. Does your automation deliver twice?

Run this free local exercise before connecting a payment event to file delivery or an AI job. It demonstrates signature checks, duplicate detection and a changed payload that must be rejected.

Download the Node.js example · Browse source on GitHub · Read the full guide

No account, API key, dependencies or payments. Requires Node.js 22 or newer. Extract the ZIP, open a terminal in its directory, and run:

node demo.mjs
node --test

The demo prints:

Attempt 1: verified payment.succeeded; dry-run only, nothing delivered
Attempt 2: duplicate skipped
Tampered payload: rejected

What you get

Readable verification code, synthetic fixtures and six local tests covering invalid signatures, changed bytes, expired timestamps and malformed requests. Everything runs on your machine.

Before connecting real delivery

The duplicate set is a teaching example. Production needs durable storage and a retryable job workflow. This download has no public receiver, customer data or fulfillment service.

Provider test, September 10: Whop sent a signed sample event to a temporary receiver using this verifier. It returned HTTP 200; an unsigned request returned 401. Both temporary resources were removed. This verifies one sample, not a real purchase or production fulfillment. See the sanitized test result.

Follow Whop's current webhook guide and send a dashboard test event to your own endpoint before adapting the code. The README explains the supported secret format and integration limits.

Evaluating Whop for your app?

Create a Whop account. We may earn commission from eligible activity through this partner link. You can use the example without signing up or using the link.

Independent example, not an official Whop SDK. No income or payment performance claims.