Your app, on your own domain.

import { db, webhooks, config } from 'hatchable';

// senders have no session: the signature is the auth
export const access = 'public';
export const methods = ['POST'];

export default async function (req, res) {
  const secret = await config.get('STRIPE_WEBHOOK_SECRET');
  const sig = req.headers['stripe-signature'] || '';
  const t  = sig.match(/t=(\d+)/)?.[1];
  const v1 = sig.match(/v1=([a-f0-9]+)/)?.[1];

  const ok = await webhooks.verifyHmac({
    raw: `${t}.${req.rawBody}`,
    signature: v1, secret, timestamp: t,
  });
  if (!ok) return res.status(400).json({ error: 'Bad signature.' });

  await db.query(
    'UPDATE orders SET paid_at = now() WHERE ref = $1',
    [req.body.data.object.id]
  );
  res.json({ received: true });
}

import { db } from 'hatchable';

// anyone, including anonymous visitors
export const access = 'public';
export const methods = ['GET'];

export default async function (req, res) {
  const { rows } = await db.query(
    `SELECT name, price_cents
       FROM dishes
      WHERE published
      ORDER BY sort_order`
  );

  res.setHeader('cache-control', 'public, max-age=60');
  res.json({ menu: rows });
}