diff --git a/app/controllers/hooks_controller.rb b/app/controllers/hooks_controller.rb
index 9245d11..c87dfe9 100644
--- a/app/controllers/hooks_controller.rb
+++ b/app/controllers/hooks_controller.rb
@@ -2,15 +2,15 @@
 
 module DiscourseSubscriptions
   class HooksController < ::ApplicationController
+    skip_before_action :verify_authenticity_token, only: [:create]
+
     def create
       begin
+        payload = request.body.read
+        sig_header = request.env['HTTP_STRIPE_SIGNATURE']
+        webhook_secret = SiteSetting.discourse_subscriptions_webhook_secret
 
-        # payload, sig_header, endpoint_secret
-        event = ::Stripe::Webhook.construct_event(
-          {},
-          'stripe-webhook-signature',
-          'endpoint_secret'
-        )
+        event = ::Stripe::Webhook.construct_event(payload, sig_header, webhook_secret)
 
       rescue JSON::ParserError => e
         # Invalid payload
diff --git a/spec/requests/hooks_controller_spec.rb b/spec/requests/hooks_controller_spec.rb
index 6cf5083..3cb2303 100644
--- a/spec/requests/hooks_controller_spec.rb
+++ b/spec/requests/hooks_controller_spec.rb
@@ -4,17 +4,19 @@ require 'rails_helper'
 
 module DiscourseSubscriptions
   RSpec.describe HooksController do
+    before do
+      SiteSetting.discourse_subscriptions_webhook_secret = 'zascharoo'
+    end
+
     it "contructs a webhook event" do
+      payload = 'we-want-a-shrubbery'
+      headers = { 'HTTP_STRIPE_SIGNATURE' => 'stripe-webhook-signature' }
+
       ::Stripe::Webhook
         .expects(:construct_event)
-        .with({}, 'stripe-webhook-signature', 'endpoint_secret')
-        .returns(true)
+        .with('we-want-a-shrubbery', 'stripe-webhook-signature', 'zascharoo')
 
-      headers = {
-        'HTTP_STRIPE_SIGNATURE' => 'stripe-webhook-signature'
-      }
-
-      post "/s/hooks.json"
+      post "/s/hooks.json", params: payload, headers: headers
 
       expect(response.status).to eq 200
     end