diff --git a/app/routers/billing.py b/app/routers/billing.py
index 2c1ef48..6ca296c 100644
--- a/app/routers/billing.py
+++ b/app/routers/billing.py
@@ -85,11 +85,11 @@ async def stripe_webhook(
         else:
             import json
             logger.warning("Stripe webhook received without signature verification (dev mode only)")
-            event = json.loads(payload)
+            event = stripe.Event.construct_from(json.loads(payload), stripe.api_key)
 
         supabase = get_supabase()
-        event_type = event.get("type", "")
-        event_id = event.get("id", "")
+        event_type = event.type
+        event_id = event.id
 
         # Idempotency check: skip already-processed events
         if event_id:
@@ -102,11 +102,11 @@ async def stripe_webhook(
                 return {"received": True}
 
         if event_type == "checkout.session.completed":
-            session = event["data"]["object"]
-            user_id = session.get("metadata", {}).get("user_id")
-            plan = session.get("metadata", {}).get("plan", "starter")
-            customer_id = session.get("customer")
-            subscription_id = session.get("subscription")
+            session = event.data.object
+            user_id = (session.metadata or {}).get("user_id")
+            plan = (session.metadata or {}).get("plan", "starter")
+            customer_id = session.customer
+            subscription_id = session.subscription
 
             if user_id:
                 supabase.table("subscriptions").upsert({
@@ -118,9 +118,9 @@ async def stripe_webhook(
                 }, on_conflict="user_id").execute()
 
         elif event_type in ("customer.subscription.updated", "customer.subscription.deleted"):
-            sub_obj = event["data"]["object"]
-            customer_id = sub_obj.get("customer")
-            status = sub_obj.get("status", "canceled")
+            sub_obj = event.data.object
+            customer_id = sub_obj.customer
+            status = sub_obj.status or "canceled"
 
             existing = supabase.table("subscriptions").select("*").eq("stripe_customer_id", customer_id).execute()
             if existing.data: