Guides

Stripe checklist for vibe-coded apps

Check your Stripe integration before launch: keys, webhooks, signature verification, subscription events and test vs live mode.

Keys

The secret key stays on the server. The browser only gets the publishable key. Test keys only work with test-mode objects and live keys with live-mode objects.

Webhook endpoint

Register the production URL as a webhook endpoint and use that endpoint's signing secret on the production host. The Stripe CLI uses a different secret for local forwarding.

Verify signatures

Verify each event with the Stripe-Signature header against the raw request body. Parsing the body as JSON first breaks verification.

Handle the events your billing needs

checkout.session.completed is not enough for subscriptions. Also handle renewal and cancellation events so access matches what the customer pays for.

Make handlers safe to retry

Stripe can send the same event more than once. Record processed event IDs or make updates idempotent.

Sources

• Stripe: webhooks
• Stripe: subscription webhooks

Have a specific error? Try the error explainer or the pre-launch checklist.