Skip to content
BuildBase

Send the payment-failed email from a Bolt app (Vite, BuildBase sign-in)

Turn on the email BuildBase sends when a card fails, plus one prompt for a signed webhook function in a Bolt.new app for your own side effects.

Bolt can also connect to BuildBase itself while it builds: Use BuildBase in Bolt.

When a renewal fails, BuildBase emails the workspace owner from your sending domain. That needs no code, only two switches in the console. The prompt adds a webhook function for what you want to happen besides, such as flagging the workspace, verified with your webhook secret. This page assumes the app already signs people in with @buildbase/sdk, as the Bolt guide sets up. If it signs people in with something else, such as Supabase or Clerk, read keep your existing sign-in first.

Before you start

A sender connected (connect a sender) and the Payment Failed notification event switched on (notification events). For the function, an endpoint at https://your-app.example.com/api/webhooks/buildbase under Settings > Webhooks, with payment.failed ticked (add an endpoint).

The prompt

Bolt's help center documents no link that opens Bolt with a prompt filled in, so copy this into your project's chat.

This app signs people in with BuildBase (@buildbase/sdk), set up as https://www.buildbase.app/guides/add-login-teams-and-paid-plans-to-a-bolt-app shows. If it does not, stop and tell me.
Read https://docs.buildbase.app/webhooks/overview.md first and do not invent event names.
Add api/webhooks/buildbase.ts as a POST function. Verify it with parseWebhookEvent from @buildbase/sdk on the raw body from request.text(), the x-buildbase-signature and x-buildbase-timestamp headers and BUILDBASE_WEBHOOK_SECRET from the host's environment variables; answer 401 when it returns null.
On payment.failed, flag the workspace in my database; do not send an email, BuildBase sends it. Answer 200 to every other event.

Where the secrets go

The console shows the endpoint's signing secret once, when you create it. Add it as BUILDBASE_WEBHOOK_SECRET where your functions run: your host's environment variables (Vercel's project settings, say), or Bolt's Secrets page, from the database icon, if Bolt hosts them. To test in the preview, put it in .env too. Never give it a VITE_ prefix.

The Bolt trap

Bolt commits every change that does not break the project to GitHub on its own. A .env that is not in .gitignore before you connect GitHub is committed with your secrets in it. Check .gitignore first. If a secret was committed, rotate it in the console (the old one stops working) and treat the old value as public.

The console's delivery log shows each attempt: a 401 means the secret did not reach the function, and HTML or a 404 means the host has no function at that address.

Full guides