fix(billing): register the Stripe plugin only when the webhook secret is configured

The Better Auth Stripe plugin was passed `STRIPE_WEBHOOK_SECRET || ''`. Stripe's verifier accepts signatures computed with an empty key, so the plugin's own falsy-secret check was the only thing keeping the receiver from accepting forged events. Billing now registers only when the webhook secret is set, logging an error otherwise, and the setup preflight requires it alongside STRIPE_SECRET_KEY.

Author: waleedlatif1

apps/sim/lib/auth/auth.ts

@@ -237,15 +237,27 @@ if (env.NODE_ENV === 'production') {
   }
 }
 
-const validStripeKey = env.STRIPE_SECRET_KEY
-
-let stripeClient = null
-if (validStripeKey) {
-  stripeClient = new Stripe(env.STRIPE_SECRET_KEY || '', {
-    apiVersion: '2025-08-27.basil',
-  })
+/**
+ * Resolves the Stripe billing plugin's client and webhook signing secret, or `null` when the plugin
+ * must not register. Stripe's verifier accepts a signature computed with an empty key, so a missing
+ * `STRIPE_WEBHOOK_SECRET` disables the plugin rather than exposing a forgeable webhook receiver.
+ */
+function resolveStripeBilling() {
+  if (!isBillingEnabled || !env.STRIPE_SECRET_KEY) return null
+  if (!env.STRIPE_WEBHOOK_SECRET) {
+    logger.error(
+      'BILLING_ENABLED and STRIPE_SECRET_KEY are set but STRIPE_WEBHOOK_SECRET is not; the Stripe billing plugin is disabled until it is configured'
+    )
+    return null
+  }
+  return {
+    client: new Stripe(env.STRIPE_SECRET_KEY, { apiVersion: '2025-08-27.basil' }),
+    webhookSecret: env.STRIPE_WEBHOOK_SECRET,
+  }
 }
 
+const stripeBilling = resolveStripeBilling()
+
 /**
  * Resolves the org's API instance URL for a freshly linked Salesforce account.
  *
@@ -967,7 +979,7 @@ export const auth = betterAuth({
       banned: false,
       banReason: null,
       banExpires: null,
-      ...(isBillingEnabled && stripeClient ? { stripeCustomerId: null } : {}),
+      ...(stripeBilling ? { stripeCustomerId: null } : {}),
       ...additionalFields,
       id,
     }),
@@ -1547,11 +1559,11 @@ export const auth = betterAuth({
      * SSO provider behind it.
      */
     ...(isSsoEnabled ? [configuredSsoPlugin] : []),
-    ...(isBillingEnabled && stripeClient
+    ...(stripeBilling
       ? [
           stripe({
-            stripeClient,
-            stripeWebhookSecret: env.STRIPE_WEBHOOK_SECRET || '',
+            stripeClient: stripeBilling.client,
+            stripeWebhookSecret: stripeBilling.webhookSecret,
             createCustomerOnSignUp: true,
             onCustomerCreate: async ({ stripeCustomer, user }) => {
               logger.info('[onCustomerCreate] Stripe customer created', {

packages/sim-setup/src/checks.ts

@@ -469,7 +469,7 @@ function checkCoherence(ctx: CheckContext): Finding[] {
   }> = [
     {
       flag: 'BILLING_ENABLED',
-      needs: ['STRIPE_SECRET_KEY'],
+      needs: ['STRIPE_SECRET_KEY', 'STRIPE_WEBHOOK_SECRET'],
       label: 'billing',
     },
     {