Security, limitations and troubleshooting
Protect Stripe credentials and diagnose the exact unsupported or failure conditions in the supplied code.
Validate Stripe webhook signatures
Accept only events signed with the stored endpoint secret.
Open guide →How-to guideUnderstand the webhook CSRF exclusion
Limit the CSRF exclusion to the inbound Stripe endpoint.
Open guide →How-to guideProtect Stripe API keys
Keep secret and publishable keys separated and environment-matched.
Open guide →How-to guideTroubleshoot an invalid Stripe key
Use the exact provider exception displayed on the gateway tab.
Open guide →How-to guideTroubleshoot an iDEAL payment that is not recorded
Check callback, webhook, transaction ID and CRM addPayment outcome before retrying.
Open guide →How-to guideUnderstand the gateway key-check implementation caveat
Know that the internal helper returns true when the stored secret is empty.
Open guide →How-to guideUnderstand the create-webhook authorisation limitation
Record that create_webhook lacks an explicit capability check.
Open guide →How-to guideUnderstand unsupported refunds
Use Stripe/core CRM refund controls because the module provides no refund action.
Open guide →How-to guideUnderstand unsupported non-EUR payments
Use another gateway for invoices requiring another currency.
Open guide →How-to guideUnderstand unsupported webhook events
Do not expect failed, cancelled, refunded or chargeback events to be processed.
Open guide →How-to guideUnderstand the absence of module cron automation
Know that no scheduled job is registered by Stripe iDEAL V2.
Open guide →How-to guideUnderstand the absence of an iDEAL report
Use core invoice payments and Stripe Dashboard for reporting.
Open guide →How-to guideUnderstand bank selection ownership
Know that Stripe embedded Checkout—not the CRM module—presents eligible iDEAL bank/payment steps.
Open guide →How-to guideTroubleshoot a missing webhook warning
Confirm the gateway is active and has a secret key before expecting the check.
Open guide →How-to guideTroubleshoot a webhook ID mismatch
Recreate the endpoint after confirming environment and URL.
Open guide →How-to guideTroubleshoot a disabled webhook
Enable the endpoint with settings permission or in Stripe Dashboard.
Open guide →