Stripe webhook · server log

Edge runtime / crypto errors

what it looks like
SubtleCryptoProvider cannot be used in a synchronous context. Use `await constructEventAsync(...)` instead of `constructEvent(...)`

What it means

constructEvent is synchronous and uses Node's crypto. On the Edge runtime or Cloudflare Workers only Web Crypto exists, which is async.

Common causes

  • export const runtime = "edge" on the webhook route
  • Deploying to Cloudflare Workers / Pages
  • A bundler polyfill that breaks node:crypto

How to fix it

  1. Simplest: export const runtime = "nodejs" on the webhook route
  2. On Edge/Workers: await stripe.webhooks.constructEventAsync(body, sig, secret, undefined, Stripe.createSubtleCryptoProvider())
  3. Still read the body with await req.text()
route.ts (Edge / Workers)
const event = await stripe.webhooks.constructEventAsync(
  await req.text(),
  sig,
  process.env.STRIPE_WEBHOOK_SECRET!,
  undefined,
  Stripe.createSubtleCryptoProvider(),
);
verify the fix
stripe listen --forward-to localhost:3000/api/stripe/webhook
# put the whsec_... it prints in .env.local, then restart npm run dev
stripe trigger checkout.session.completed

pass if stripe listen prints [200] for every forwarded event, not 400 or 500.

works with stripe-node 23.0.0 · Next.js 16.4.3 App Routerlast verified CLI steps: Stripe CLI 1.55.2, Oct 27, 2026

prevent it · stripe-webhooks.mdc (free Cursor Rules Pack): Keeps the webhook handler on the Node.js runtime.

Prompt for Cursor or Claude Code

My Stripe webhook throws a crypto/SubtleCryptoProvider error. Check the runtime of src/app/api/stripe/webhook/route.ts. If I'm not deploying to an edge-only platform, set runtime = "nodejs". Otherwise switch to await constructEventAsync with Stripe.createSubtleCryptoProvider().

Not quite your error? Paste yours into the free VibeBoot Doctor or browse the Stripe webhook fixer.

next: skip the next one

Skip the setup. The VibeBoot SaaS Starter ships Stripe Checkout, the billing portal and a signature-verified webhook already wired, plus auth and a database on Next.js 16.4.3. $49, one-time.

14-day money-back guarantee · lifetime updates

$ fixed it? get the next one first

New fixes for what AI agents break, by email.

When we add a fix or a Cursor rule for a new Next.js, Auth.js, Prisma or Stripe break, it goes out in the VibeBoot newsletter. Free, occasional, unsubscribe in one click.

Subscribe free