Skip to main content

Scheduled jobs

All times are UTC. Every job writes a job run, and only one run of a job is active at a time. The jobs are staggered by a minute so captures land before the payout run that pays them.

Subscribers

Webhook events

Platform account

POST /hooks/payment/pp_stripe-connector_stripe, verified with the payment provider’s webhookSecret. Handled by Medusa’s payment module.

Connected accounts

POST /hooks/payout, verified with the payout provider’s webhookSecret. Core’s payout webhook subscriber and the plugin’s subscriber both read it. Every verified event also updates Last webhook on Settings → Stripe.

Admin routes

All routes need an authenticated admin user. GET routes need payouts:view, the others payouts:edit. Payout accounts, payouts and their retries use core’s routes under /admin/payout-accounts and /admin/payouts. See the Payout module.

Vendor routes

Scoped to the authenticated seller, with payouts:view. The seller’s payout account and onboarding use core’s /vendor/payout-accounts routes.

Events

Core’s payout module emits payout_account.updated, payout.failed, payout.reversal_failed and payout.webhook_received.

Payout statuses

Payouts, reversals, adjustments and settlement bank payouts share core’s status machine.

Reasons

Each held, failed or aborted record carries a stable status_reason:

Notification types

Every request body is { "type": "...", "payload": { ... } }.

Notification signatures

With notifications.secret set, every notification carries:
where <hex> is the HMAC-SHA256 of the raw request body with your secret, hex-encoded. Verify it against the raw body, before parsing:

Tables

The plugin’s stripe_connector module adds: The links are read-only, so traverse them from the plugin’s side. For example, a seller’s settlements with their store and the orders behind each payout: