Stripe technical guide

@RestResource(urlMapping='/webhook/*')
global with sharing class InboundWebhookResource {
  @HttpPost
  global static void handle() {
    RestRequest req = RestContext.request;
    String raw = req.requestBody.toString();

    if (!WebhookSignature.isValid(raw, req.headers.get('X-Signature'))) {
      RestContext.response.statusCode = 401;      // reject unverified events
      return;
    }
    Inbound_Event__c e = new Inbound_Event__c(
      Event_Id__c = EventParser.idOf(raw), Payload__c = raw);
    upsert e Event_Id__c;                         // idempotent capture
    System.enqueueJob(new EventProcessor(e.Id));  // process asynchronously
    RestContext.response.statusCode = 200;         // respond fast
  }
}

public class WebhookSignature {
  public static Boolean isValid(String rawBody, String header) {
    Blob secret = Blob.valueOf(WebhookConfig.signingSecret());
    Blob mac = Crypto.generateMac('HmacSHA256', Blob.valueOf(rawBody), secret);
    String expected = EncodingUtil.convertToHex(mac);
    // constant-time compare guards against timing attacks
    return ConstantTime.equals(expected, header);
  }
}

public class EventProcessor implements Queueable {
  private Id eventId;
  public EventProcessor(Id eventId) { this.eventId = eventId; }

  public void execute(QueueableContext ctx) {
    Inbound_Event__c e = [SELECT Payload__c FROM Inbound_Event__c WHERE Id = :eventId];
    Map<String,Object> body = (Map<String,Object>) JSON.deserializeUntyped(e.Payload__c);
    // heavy work runs here, off the webhook thread: map onto Accounts, Cases, Payments
    EventRouter.route(body);
    update new Inbound_Event__c(Id = eventId, Processed__c = true, Processed_At__c = System.now());
  }
}