Webhook operations

Better Auth’s Stripe plugin remains responsible for signature verification and subscription state transitions. Application callbacks project successful subscription changes into tenant entitlements and an immutable audit trail.

Each callback attempt records a tenant-scoped delivery status without retaining the raw payment payload:

Stripe → Better Auth signed webhook → local projection → completed / failed

Owners and admins can inspect the latest 100 attempts on the Operations screen. A failed projection is reattempted when Stripe retries the same signed event. Provider event IDs and local billing events are unique, so repeated delivery is idempotent.

Do not create an unsigned manual replay endpoint. Use Stripe’s event resend controls so Better Auth performs signature verification again.