Stripe event: checkout.session.expired, release what you held and consider the recovery email

checkout.session.expired: clean up and optionally recover

The Checkout Session expired without payment (sessions expire 24 hours after creation by default). The customer is gone, but your system may still be holding things for them.

What to do on receipt

1. Release anything you held for this session: reserved inventory, held seats, locked promo codes, temporary accounts. If you do not, they leak.
2. Mark the checkout attempt abandoned in your records, linked to the customer if you know who they were.
3. Optionally send a recovery email: "still interested?" with a fresh checkout link. This is one of the highest-ROI emails in ecommerce; the event hands you the trigger for free.
4. Return 200.

The trap

No handler at all. Most integrations listen for completed and ignore expired, so abandoned sessions pile up as phantom reservations. The subtler trap: treating expired as a failure to retry automatically. Do not create a new session unprompted; invite, do not ambush.

Checklist

• You can set a custom expiry with expires_at when creating the session (between 30 minutes and 24 hours). If you do, your cleanup timing should match your setting, not the default.
• Distinguish expired from async_payment_failed. Expired means the customer walked away. The async failure events mean they tried and the money failed; those get dunning, not recovery emails.

Stripe's event reference says checkout.session.expired occurs when a Checkout Session is expired. Verified live at https://docs.stripe.com/api/events/types. Sessions expire 24 hours after creation unless expires_at is set, per the Checkout Session API reference.