checkout.session.expired returning error 400

[Stealthwriter]

Bug Report

Summary
All other Stripe webhook events are working, but checkout.session.expired returns an error.

---

Error Message

Webhook Error: Invalid API Key provided: sk_live_************************************************************************************************yrW3

---

Event Payload

Received from Stripe to /webhooks:

{
  "id": "evt_1S8bvmB9G8rKmdS63kkohIJ2",
  "object": "event",
  "api_version": "2023-10-16",
  "created": 1758179222,
  "data": {
    "object": {
      "id": "cs_live_b1MtpwY9er2giwMTl5zvJHJqLTHr0JO5DKN6RKiqKufYbTRoRWDg2UZ0kA",
      "object": "checkout.session",
      "amount_subtotal": 2000,
      "amount_total": 1400,
      "currency": "usd",
      "customer": "cus_T4NmrYOS2wnkAO",
      "discounts": [
        {
          "promotion_code": "promo_1Q6Uc5B9G8rKmdS6l6bPwOYj"
        }
      ],
      "expires_at": 1758179220,
      "livemode": true,
      "mode": "subscription",
      "payment_status": "unpaid",
      "status": "expired",
      "success_url": "https://hidden?success=true&session_id={CHECKOUT_SESSION_ID}&price=20&email=hidden",
      "cancel_url": "https://hiddenpricing?canceled=true"
    }
  },
  "livemode": true,
  "pending_webhooks": 2,
  "type": "checkout.session.expired"
}

---

Steps to Reproduce

1. Create a checkout session in live mode.
2. Let the session expire without completion.
3. Observe the webhook call to /webhooks.

---

Expected Behavior

Webhook event checkout.session.expired should be processed without error.

---

Actual Behavior

Webhook returns:

Webhook Error: Invalid API Key provided

---

Notes

• Other webhook event types succeed.
• Only checkout.session.expired causes this error.

---

[Niki2k1]

Hey I tried to reproduce your error with the following steps:

1. set your test api key in the .env
2. use stripe-cli to forward webhooks: stripe listen --forward-to localhost:8080/webhooks
3. set the webhook secret in the .env
4. start fastify-app from this repo
5. trigger the checkout.session.expired event stripe trigger checkout.session.expired

The chechkout.session uses the api to fetch line_items, are you sure you are using a correct api key?

Also in my live environment I don't see any errors and my rows in the checkout_session table do have the status "expired" so I believe everything works fine.