calcom/cal.diy · info · HttpCode

Payment not for cal.com

Error message

Payment not for cal.com

What it means

Thrown when the Alby webhook event's metadata.payer_data.appId is not 'cal.com'. Cal.com stamps every invoice it creates with appId:'cal.com', so events lacking it belong to a different consumer of the same Alby account and are intentionally ignored (HTTP 204 No Content).

Source

Thrown at packages/app-store/alby/api/webhook.ts:47

    const parseHeaders = webhookHeadersSchema.safeParse(headers);
    if (!parseHeaders.success) {
      console.error(parseHeaders.error);
      throw new HttpCode({ statusCode: 400, message: "Bad Request" });
    }

    const { data: parsedHeaders } = parseHeaders;

    const parse = eventSchema.safeParse(JSON.parse(bodyAsString));
    if (!parse.success) {
      console.error(parse.error);
      throw new HttpCode({ statusCode: 400, message: "Bad Request" });
    }

    const { data: parsedPayload } = parse;

    if (parsedPayload.metadata?.payer_data?.appId !== "cal.com") {
      throw new HttpCode({ statusCode: 204, message: "Payment not for cal.com" });
    }

    const payment = await prisma.payment.findFirst({
      where: {
        uid: parsedPayload.metadata.payer_data.referenceId,
      },
      select: {
        id: true,
        amount: true,
        bookingId: true,
        booking: {
          select: {
            user: {
              select: {
                credentials: {
                  where: {
                    type: "alby_payment",
                  },

View on GitHub (pinned to 176037d0af)

Solutions

1. Use a dedicated Alby account and webhook endpoint per cal.com instance.
2. Treat HTTP 204 here as benign - the event was intentionally ignored.
3. Confirm the invoice was created by this cal.com instance (it sets appId:'cal.com' in payerdata).

const isCalComPayer = (p: { appId?: string } | undefined) => p?.appId === 'cal.com';

When it happens

Trigger: The same Alby lightning address/webhook secret is shared with another application; a stale webhook from before cal.com tagging; a malicious or erroneous event with a different/missing appId.

Common situations: Shared Alby account across projects; webhook endpoint secret reused across instances; test events fired manually without the appId marker.

Related errors

• Method Not Allowed
• Bad Request
• Payment not found
• Credentials not found
• Invoice not found

AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/b29654e410a900e9. Report an issue: GitHub.