{"record":{"id":"b29654e410a900e9","repo":"calcom/cal.diy","slug":"payment-not-for-cal-com","errorCode":null,"errorMessage":"Payment not for cal.com","messagePattern":"Payment not for cal\\.com","errorType":"http","errorClass":"HttpCode","httpStatus":204,"severity":"info","filePath":"packages/app-store/alby/api/webhook.ts","lineNumber":47,"sourceCode":"\n    const parseHeaders = webhookHeadersSchema.safeParse(headers);\n    if (!parseHeaders.success) {\n      console.error(parseHeaders.error);\n      throw new HttpCode({ statusCode: 400, message: \"Bad Request\" });\n    }\n\n    const { data: parsedHeaders } = parseHeaders;\n\n    const parse = eventSchema.safeParse(JSON.parse(bodyAsString));\n    if (!parse.success) {\n      console.error(parse.error);\n      throw new HttpCode({ statusCode: 400, message: \"Bad Request\" });\n    }\n\n    const { data: parsedPayload } = parse;\n\n    if (parsedPayload.metadata?.payer_data?.appId !== \"cal.com\") {\n      throw new HttpCode({ statusCode: 204, message: \"Payment not for cal.com\" });\n    }\n\n    const payment = await prisma.payment.findFirst({\n      where: {\n        uid: parsedPayload.metadata.payer_data.referenceId,\n      },\n      select: {\n        id: true,\n        amount: true,\n        bookingId: true,\n        booking: {\n          select: {\n            user: {\n              select: {\n                credentials: {\n                  where: {\n                    type: \"alby_payment\",\n                  },","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/calcom/cal.diy/blob/176037d0afbe572f870a3c702985e7cd83fe6c0c/packages/app-store/alby/api/webhook.ts#L29-L65","documentation":"Thrown when the Alby webhook event's metadata.payer_data.appId is not 'cal.com'. Cal.com stamps every invoice it creates with appId:'cal.com', so events lacking it belong to a different consumer of the same Alby account and are intentionally ignored (HTTP 204 No Content).","triggerScenarios":"The same Alby lightning address/webhook secret is shared with another application; a stale webhook from before cal.com tagging; a malicious or erroneous event with a different/missing appId.","commonSituations":"Shared Alby account across projects; webhook endpoint secret reused across instances; test events fired manually without the appId marker.","solutions":["Use a dedicated Alby account and webhook endpoint per cal.com instance.","Treat HTTP 204 here as benign - the event was intentionally ignored.","Confirm the invoice was created by this cal.com instance (it sets appId:'cal.com' in payerdata)."],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":"const isCalComPayer = (p: { appId?: string } | undefined) => p?.appId === 'cal.com';","tryCatchPattern":null,"preventionTips":["Dedicate one Alby account/webhook per cal.com instance.","Treat HTTP 204 here as an intentional ignore, not a failure.","Ensure invoices are always created with appId:'cal.com' in payerdata."],"tags":["alby","webhook","multi-tenant","ignored"],"backgroundTag":null,"analyzedSha":"176037d0afbe572f870a3c702985e7cd83fe6c0c","analyzedAt":"2026-08-12T19:12:41.464Z","schemaVersion":2},"datasetVersion":"2026-08-13T04:17:16.726Z"}