proper webhook secret

account/src/lib/env-vars.ts

@@ -10,6 +10,7 @@ const names = [
     "LINGDOCS_ACCOUNT_RECAPTCHA_SECRET",
     "LINGDOCS_ACCOUNT_UPGRADE_PASSWORD",
     "STRIPE_SECRET_KEY",
+    "STRIPE_WEBHOOK_SECRET",
 ];
 
 const values = names.map((name) => ({
@@ -35,4 +36,5 @@ export default {
     recaptchaSecret: values[8].value,
     upgradePassword: values[9].value,
     stripeSecretKey: values[10].value,
+    stripeWebhookSecret: values[11].value,
 };

account/src/routers/payment-router.ts

@@ -18,7 +18,7 @@ paymentRouter.post(
     // If you are testing with the CLI, find the secret by running 'stripe listen'
     // If you are using an endpoint defined with the API or dashboard, look in your webhook settings
     // at https://dashboard.stripe.com/webhooks
-    const endpointSecret = 'whsec_12345';
+    const endpointSecret = env.stripeWebhookSecret;
     // Only verify the event if you have an endpoint secret defined.
     // Otherwise use the basic event deserialized with JSON.parse
     if (endpointSecret) {