# Send the payment-failed email from a Bolt app (Vite, BuildBase sign-in)

Turn on the email BuildBase sends when a card fails, plus one prompt for a signed webhook function in a Bolt.new app for your own side effects.

Bolt can also connect to BuildBase itself while it builds: [Use BuildBase in Bolt](/console/ai-agents/bolt).

When a renewal fails, BuildBase emails the workspace owner from your sending domain. That needs no code, only two switches in the console. The prompt adds a webhook function for what you want to happen besides, such as flagging the workspace, verified with your webhook secret. This page assumes the app already signs people in with @buildbase/sdk, as the [Bolt guide](https://www.buildbase.app/guides/add-login-teams-and-paid-plans-to-a-bolt-app) sets up. If it signs people in with something else, such as Supabase or Clerk, read [keep your existing sign-in](/sign-in-setup/keep-your-sign-in) first.

> **Note:**
  A sender connected ([connect a sender](/email/connect-a-sender)) and the
  **Payment Failed** notification event switched on
  ([notification events](/notifications/events)). For the function, an endpoint
  at `https://your-app.example.com/api/webhooks/buildbase` under **Settings** >
  **Webhooks**, with `payment.failed` ticked ([add an
  endpoint](/webhooks/add-an-endpoint)).

## The prompt

Bolt's help center documents no link that opens Bolt with a prompt filled in, so copy this into your project's chat.

```text
This app signs people in with BuildBase (@buildbase/sdk), set up as https://www.buildbase.app/guides/add-login-teams-and-paid-plans-to-a-bolt-app shows. If it does not, stop and tell me.
Read https://docs.buildbase.app/webhooks/overview.md first and do not invent event names.
Add api/webhooks/buildbase.ts as a POST function. Verify it with parseWebhookEvent from @buildbase/sdk on the raw body from request.text(), the x-buildbase-signature and x-buildbase-timestamp headers and BUILDBASE_WEBHOOK_SECRET from the host's environment variables; answer 401 when it returns null.
On payment.failed, flag the workspace in my database; do not send an email, BuildBase sends it. Answer 200 to every other event.
```

## Where the secrets go

The console shows the endpoint's signing secret once, when you create it. Add it as `BUILDBASE_WEBHOOK_SECRET` where your functions run: your host's environment variables (Vercel's project settings, say), or Bolt's Secrets page, from the database icon, if Bolt hosts them. To test in the preview, put it in `.env` too. Never give it a `VITE_` prefix.

## The Bolt trap

Bolt commits every change that does not break the project to GitHub on its own. A `.env` that is not in `.gitignore` before you connect GitHub is committed with your secrets in it. Check `.gitignore` first. If a secret was committed, rotate it in the console (the old one stops working) and treat the old value as public.

The console's delivery log shows each attempt: a 401 means the secret did not reach the function, and HTML or a 404 means the host has no function at that address.

## Full guides

- [Add login, teams and paid plans to a Bolt.new app](https://www.buildbase.app/guides/add-login-teams-and-paid-plans-to-a-bolt-app)
- [Failed payments](/billing/failed-payments): retries, grace days and the emails
- [Add BuildBase to Bolt's knowledge or skills](/ai-builders/bolt-import)