A completed Stripe Checkout Session can still be unpaid, so check payment_status before fulfilling

The checkout.session.completed event fires when the customer finishes the flow, not when money settles. For delayed-notification methods such as SEPA direct debit, Bacs, boleto and OXXO, the session arrives with payment_status set to unpaid and settles hours or days later, at which point Stripe sends checkout.session.async_payment_succeeded or checkout.session.async_payment_failed. Card payments arrive with payment_status already paid.

Fulfilling on completion alone therefore ships goods for payments that may still fail. Confirm in test mode by enabling a delayed method and completing a session. Gate fulfilment on payment_status equal to paid inside the completion handler, handle the two async events for everything else, and use the same idempotency key on both paths so they cannot fulfil twice.