Shipping Paddle Billing on Cloudflare Workers: Webhooks, Idempotency, and the Annoying Edge Cases

Paddle is a merchant of record billing platform — they handle tax, compliance, and payment processing globally. You integrate once and they deal with VAT, sales tax, and currency conversion. For a small team, that's a compelling trade.

We run Peeksy's billing entirely through Paddle Billing (the newer API, not Paddle Classic). The API runs on Cloudflare Workers with D1 as the database. Here's what took longer than it should have.

Webhook signature verification in the edge runtime

Paddle signs every webhook with HMAC-SHA256. Verifying the signature is the first thing you should do before processing any event.

In Node.js, this is crypto.createHmac. In Cloudflare Workers, you use the Web Crypto API:

```typescript

async function verifyPaddleSignature(

rawBody: string,