calcom/cal.diy · warning · HttpCode

Payment not found

Error message

Payment not found

What it means

Thrown when no Payment row matches uid === parsedPayload.metadata.payer_data.referenceId. The reference id embedded in the invoice's payer data does not correspond to any payment recorded by this cal.com instance. Returns HTTP 204 so Svix does not keep retrying.

Source

Thrown at packages/app-store/alby/api/webhook.ts:74

        amount: true,
        bookingId: true,
        booking: {
          select: {
            user: {
              select: {
                credentials: {
                  where: {
                    type: "alby_payment",
                  },
                },
              },
            },
          },
        },
      },
    });

    if (!payment) throw new HttpCode({ statusCode: 204, message: "Payment not found" });
    const key = payment.booking?.user?.credentials?.[0].key;
    if (!key) throw new HttpCode({ statusCode: 204, message: "Credentials not found" });

    const parseCredentials = albyCredentialKeysSchema.safeParse(key);
    if (!parseCredentials.success) {
      console.error(parseCredentials.error);
      throw new HttpCode({ statusCode: 500, message: "Credentials not valid" });
    }

    const credentials = parseCredentials.data;

    const albyInvoice = await parseInvoice(bodyAsString, parsedHeaders, credentials.webhook_endpoint_secret);
    if (!albyInvoice) throw new HttpCode({ statusCode: 204, message: "Invoice not found" });
    if (albyInvoice.amount !== payment.amount) {
      throw new HttpCode({ statusCode: 400, message: "invoice amount does not match payment amount" });
    }

    const traceContext = distributedTracing.createTrace("alby_webhook", {

View on GitHub (pinned to 176037d0af)

Solutions

  1. Look up the payment table for the given referenceId (uid) to confirm it exists.
  2. Ensure invoice creation (prisma.payment.create) is committed before the webhook can arrive, or rely on Svix redelivery.
  3. Confirm a single DB instance owns this webhook secret to avoid cross-instance lookups.
Defensive patterns

Strategy: validation

Validate before calling

const payment = await prisma.payment.findFirst({
  where: { uid: parsedPayload.metadata.payer_data.referenceId },
});
if (!payment) {
  // return 204; rely on Svix redelivery after create commits
}

Prevention

When it happens

Trigger: Webhook delivered before prisma.payment.create committed; payment belongs to a different DB/instance sharing the secret; referenceId tampered; payment row was deleted.

Common situations: Race between invoice creation and webhook delivery; multi-instance deployment with separate DBs; DB restore where payment rows were lost.

Related errors


AI-assisted analysis of calcom/cal.diy@176037d0af (2026-08-12). Data as JSON: /api/errors/0d11acd49a589db2. Report an issue: GitHub.