diff --git a/src/lib/payments/polar.ts b/src/lib/payments/polar.ts
index 3f69007..d3e0275 100644
--- a/src/lib/payments/polar.ts
+++ b/src/lib/payments/polar.ts
@@ -70,10 +70,11 @@ export function verifyPolarWebhook(
 
   const signedContent = `${webhookId}.${webhookTimestamp}.${rawBody}`;
 
-  // Secret base64 olabilir
+  // Polar secret: "polar_whs_<base64>" — prefix soyulup base64 decode edilir
   let secretBytes: Buffer;
   try {
-    secretBytes = Buffer.from(WEBHOOK_SECRET.replace(/^whsec_/, ""), "base64");
+    const raw = WEBHOOK_SECRET.replace(/^(whsec_|polar_whs_)/, "");
+    secretBytes = Buffer.from(raw, "base64");
   } catch {
     secretBytes = Buffer.from(WEBHOOK_SECRET);
   }