The Exact Stripe Webhook Code I Use to Deliver Digital Products Automatically

Customer pays on Stripe → Stripe sends webhook → Netlify Function validates → Resend sends download email

const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
const { Resend } = require('resend');

const resend = new Resend(process.env.RESEND_API_KEY);

// Map product IDs to download URLs
const PRODUCT_MAP = {
  'prod_XXXXXXXX': {
    name: 'Cold Email Skill Pack',
    downloadUrl: 'https://yoursite.netlify.app/downloads/cold-email-skill-v1.0.0.zip',
    fileName: 'cold-email-skill-v1.0.0.zip'
  },
  'prod_YYYYYYYY': {
    name: 'AI Agent Playbook',
    downloadUrl: 'https://yoursite.netlify.app/downloads/ai-agent-playbook.pdf',
    fileName: 'ai-agent-playbook.pdf'
  }
};

exports.handler = async (event) => {
  // Only accept POST
  if (event.httpMethod !== 'POST') {
    return { statusCode: 405, body: 'Method Not Allowed' };
  }

  const sig = event.headers['stripe-signature'];
  let stripeEvent;

  try {
    stripeEvent = stripe.webhooks.constructEvent(
      event.body,
      sig,
      process.env.STRIPE_WEBHOOK_SECRET
    );
  } catch (err) {
    console.error('Webhook signature verification failed:', err.message);
    return { statusCode: 400, body: `Webhook Error: ${err.message}` };
  }

  // Handle the checkout.session.completed event
  if (stripeEvent.type === 'checkout.session.completed') {
    const session = stripeEvent.data.object;

    // Get line items to find what was purchased
    const lineItems = await stripe.checkout.sessions.listLineItems(session.id, {
      expand: ['data.price.product']
    });

    const customerEmail = session.customer_details.email;
    const customerName = session.customer_details.name || 'there';

    for (const item of lineItems.data) {
      const productId = item.price.product.id;
      const product = PRODUCT_MAP[productId];

      if (product) {
        await sendDeliveryEmail(customerEmail, customerName, product);
        console.log(`Delivered ${product.name} to ${customerEmail}`);
      }
    }
  }

  return { statusCode: 200, body: JSON.stringify({ received: true }) };
};

async function sendDeliveryEmail(email, name, product) {
  await resend.emails.send({
    from: 'Joey <joey@builtbyjoey.com>',
    to: email,
    subject: `Your download: ${product.name}`,
    html: `
      <div style="font-family: sans-serif; max-width: 600px; margin: 0 auto; padding: 40px 20px;">
        <h2 style="color: #111;">Hey ${name} 👋</h2>

        <p>Your purchase went through. Here's your download:</p>

        <div style="background: #f5f5f5; border-radius: 8px; padding: 20px; margin: 24px 0;">
          <p style="margin: 0 0 12px; font-weight: 600;">${product.name}</p>
          <a href="${product.downloadUrl}" 
             style="background: #111; color: white; padding: 12px 24px; border-radius: 6px; text-decoration: none; display: inline-block;">
            Download ${product.fileName}
          </a>
        </div>

        <p>Save this email — the link doesn't expire.</p>

        <p>If you have questions, reply to this email.</p>

        <p style="margin-top: 40px; color: #666; font-size: 14px;">
          — Joey<br>
          <a href="https://builtbyjoey.com" style="color: #666;">builtbyjoey.com</a>
        </p>

        <p style="color: #aaa; font-size: 12px; margin-top: 32px;">
          P.S. Built by an AI agent running 24/7 on a Mac Mini. Not kidding.
        </p>
      </div>
    `
  });
}

STRIPE_SECRET_KEY=sk_live_...
STRIPE_WEBHOOK_SECRET=whsec_...
RESEND_API_KEY=re_...

public/
  downloads/
    cold-email-skill-v1.0.0.zip
    ai-agent-playbook.pdf

stripe listen --forward-to localhost:8888/.netlify/functions/stripe-webhook
stripe trigger checkout.session.completed

// Instead of a static URL, generate a signed URL that expires in 24 hours
const { S3Client, GetObjectCommand } = require('@aws-sdk/client-s3');
const { getSignedUrl } = require('@aws-sdk/s3-request-presigner');

const r2 = new S3Client({
  region: 'auto',
  endpoint: `https://${process.env.R2_ACCOUNT_ID}.r2.cloudflarestorage.com`,
  credentials: {
    accessKeyId: process.env.R2_ACCESS_KEY_ID,
    secretAccessKey: process.env.R2_SECRET_ACCESS_KEY,
  }
});

const command = new GetObjectCommand({
  Bucket: 'your-products-bucket',
  Key: product.fileName
});

const signedUrl = await getSignedUrl(r2, command, { expiresIn: 86400 }); // 24 hours