Stripe revenue attribution in a cookieless world. The webhook patterns that hold up

browser     analytics worker     stripe checkout     stripe webhook
  |              |                    |                    |
  | sessionId    |                    |                    |
  |------------->|                    |                    |
  |                                                        |
  | redirect to checkout with sessionId in metadata        |
  |------------------------------>                         |
  |                                   payment              |
  |                                   --->                 |
  |                                          fires event   |
  |                                          ----------->  |
  |                                              read sessionId
  |                                              attribute revenue

// in the customer's checkout creation code
const sessionId = window.zenovay?.sessionId();

const checkout = await stripe.checkout.sessions.create({
  line_items: [...],
  mode: 'payment',
  metadata: {
    zenovay_session_id: sessionId,
    zenovay_utm_source: window.zenovay?.attribution()?.utmSource,
    zenovay_first_seen: window.zenovay?.attribution()?.firstSeen,
  },
  success_url: 'https://example.com/success',
  cancel_url: 'https://example.com/cancel',
});

export async function handleStripeWebhook(req: Request, env: Env): Promise<Response> {
  const sig = req.headers.get('stripe-signature') ?? '';
  const body = await req.text();

  let event: Stripe.Event;
  try {
    event = stripe.webhooks.constructEvent(body, sig, env.STRIPE_WEBHOOK_SECRET);
  } catch {
    return new Response('invalid signature', { status: 400 });
  }

  if (event.type === 'checkout.session.completed') {
    const session = event.data.object as Stripe.Checkout.Session;
    await attributeRevenue(env, {
      sessionId: session.metadata?.zenovay_session_id,
      amount: session.amount_total,
      currency: session.currency,
      stripeEventId: event.id,
      utmSource: session.metadata?.zenovay_utm_source,
    });
  }

  if (event.type === 'charge.refunded') {
    await reverseAttribution(env, event.data.object.payment_intent as string);
  }

  return new Response('ok');
}

async function attributeRevenue(env: Env, data: AttributionInput) {
  const seen = await env.KV.get(`stripe:event:${data.stripeEventId}`);
  if (seen) return;

  await env.DB.prepare(
    `INSERT INTO revenue_attribution
     (session_id, amount, currency, utm_source, stripe_event_id, created_at)
     VALUES (?, ?, ?, ?, ?, ?)`
  )
  .bind(data.sessionId, data.amount, data.currency, data.utmSource, data.stripeEventId, Date.now())
  .run();

  await env.KV.put(`stripe:event:${data.stripeEventId}`, '1', { expirationTtl: 86400 * 30 });
}