docs: add stripe webhook and oauth setup guide

[dsk-dev-ai]

Fixes #2969

Description

This PR adds a complete Stripe integration setup guide including:

• Webhook configuration steps
• Required webhook events
• Signing secret usage
• Stripe OAuth onboarding setup
• Required redirect URIs
• Expected flow explanation

The documentation helps users configure Stripe without trial and error.

Type

• Documentation

Summary by Sourcery

Add a dedicated guide for configuring Stripe webhooks and OAuth integration in Eventyay.

Documentation:

• Document step-by-step Stripe webhook setup including endpoint URLs, required events, and signing secret usage.
• Add instructions for configuring Stripe OAuth/Connect, including client credentials, redirect URIs, and expected onboarding flow.
• Describe common Stripe integration issues and resolutions related to webhooks, OAuth, and payment updates.

[sourcery-ai]

Reviewer's Guide

Adds a new Stripe integration setup guide document detailing how to configure Stripe webhooks and OAuth (Connect) for Eventyay, including required endpoints, events, secrets, redirect URIs, expected flow, and common troubleshooting tips.

Sequence diagram for Stripe OAuth Connect onboarding flow

sequenceDiagram
  actor Organizer
  participant Frontend
  participant Stripe
  participant Backend
  participant Database

  Organizer->>Frontend: Click Connect_Stripe
  Frontend->>Stripe: Redirect to Stripe OAuth with client_id and redirect_uri /_stripe/oauth_return/
  Stripe->>Organizer: Display onboarding screens
  Organizer->>Stripe: Provide account and payout details
  Stripe-->>Frontend: Redirect browser to /_stripe/oauth_return/ with auth_code
  Frontend->>Backend: POST /_stripe/oauth_return/ with auth_code
  Backend->>Stripe: Exchange auth_code for Stripe account details
  Stripe-->>Backend: Return Stripe account_id and tokens
  Backend->>Database: Store Stripe account connection for organizer
  Backend-->>Frontend: Return success status
  Frontend-->>Organizer: Show Stripe_connected confirmation

Loading

Sequence diagram for Stripe webhook event handling

sequenceDiagram
  participant Stripe
  participant Backend
  participant Database

  Stripe->>Backend: POST /api/v1/stripe/webhook with event_payload and signature
  Backend->>Backend: Verify signature using webhook_signing_secret
  Backend->>Backend: Parse event_type
  alt checkout_session_completed
    Backend->>Database: Mark order as paid and finalize registration
  else payment_intent_succeeded
    Backend->>Database: Update payment status to succeeded
  else payment_intent_payment_failed
    Backend->>Database: Update payment status to failed
  else charge_refunded
    Backend->>Database: Mark order as refunded and adjust balances
  end
  Backend-->>Stripe: Respond 200 acknowledgment

Loading

File-Level Changes

Change	Details	Files
Document Stripe webhook configuration required for Eventyay, including endpoints, events, and signing secret usage.	Add step-by-step instructions for creating a webhook endpoint in the Stripe Dashboard and pointing it to the Eventyay backend URL for production and local development. List the specific Stripe webhook event types that must be enabled for correct payment and refund handling. Explain how to retrieve the Stripe webhook signing secret and where to configure it in the Eventyay admin payment settings.	docs/stripe-setup.md
Document Stripe OAuth (Connect) onboarding setup and required redirect URIs for Eventyay organizers.	Describe enabling Stripe Connect OAuth for Standard and Express accounts in the Stripe Dashboard and obtaining client credentials (Client ID and Secret Key). Specify the redirect URIs that must be registered in Stripe for production and local environments and their role in the OAuth callback flow. Outline how to configure the Stripe Client ID and Secret Key in Eventyay admin payment settings and summarize the expected Connect flow and common issues.	docs/stripe-setup.md

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#2969	Add clear documentation for Stripe webhook configuration, including where to create the webhook in Stripe, which endpoint URL to use, which events to enable, how to find the signing secret, and how to enter the webhook configuration in Eventyay.	✅
#2969	Add clear documentation for Stripe OAuth configuration, including where to configure the OAuth/Connect application in Stripe, which client credentials are required, how OAuth is connected to Eventyay, and which redirect URIs must be registered (listing all required redirect URIs such as /_stripe/oauth_return/).	✅

Possibly linked issues

• Add documentation for Stripe webhook setup and Stripe OAuth configuration #2969: PR introduces stripe-setup.md documenting webhook setup, OAuth onboarding, and all required redirect URIs as requested.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've left some high level feedback:

• Consider clarifying which URLs are frontend vs backend (e.g., why webhooks use :5000 and OAuth redirects use :3000 in local development) so users know which service should be running on each port.
• It may be helpful to explicitly call out that your-domain.com should be replaced with the actual backend/API domain used by Eventyay deployments, and whether this differs from the public frontend domain.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider clarifying which URLs are frontend vs backend (e.g., why webhooks use :5000 and OAuth redirects use :3000 in local development) so users know which service should be running on each port.
- It may be helpful to explicitly call out that `your-domain.com` should be replaced with the actual backend/API domain used by Eventyay deployments, and whether this differs from the public frontend domain.

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[dsk-dev-ai]

Hey - I've left some high level feedback:

• Consider clarifying which URLs are frontend vs backend (e.g., why webhooks use :5000 and OAuth redirects use :3000 in local development) so users know which service should be running on each port.
• It may be helpful to explicitly call out that your-domain.com should be replaced with the actual backend/API domain used by Eventyay deployments, and whether this differs from the public frontend domain.

Prompt for AI Agents

Please address the comments from this code review:

## Overall Comments
- Consider clarifying which URLs are frontend vs backend (e.g., why webhooks use :5000 and OAuth redirects use :3000 in local development) so users know which service should be running on each port.
- It may be helpful to explicitly call out that `your-domain.com` should be replaced with the actual backend/API domain used by Eventyay deployments, and whether this differs from the public frontend domain.

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

I have done all changes plz review it...

[dsk-dev-ai]

checkout this updated...

[dsk-dev-ai]

I have addressed the feedback regarding frontend vs backend URLs and domain clarification. Please review. Thank you!