Ship It Checklist

Checklists /Lovable + Supabase /Payments

Critical

Calculate the amount charged on the server

If the browser tells Stripe how much to charge, a visitor can change that number. Lovable apps often put the price in the checkout request. The server, or a Supabase Edge Function, should look up the price and create the Stripe session.

How to check

  1. Search the project for stripe and checkout.
  2. If the browser calls Stripe with an amount, or posts an amount that the server trusts, stop and fix it before taking a real payment.
  3. Confirm the Stripe secret key is not in frontend code. Only a publishable key may be there.
  4. Place a test-mode payment and confirm the paid amount matches the price in your database or price list, not a value from the form.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this repository. Do not add features.

Goal: the amount a customer pays must be decided on the server. The browser must not choose the price.

Steps:
1. Find the checkout code. If it runs in the browser and sends an amount, move session creation to a server function or Supabase Edge Function.
2. The server should load the price id or amount from trusted data, then create the Checkout Session with the Stripe secret key.
3. The secret key must come from an environment variable that is not exposed to the client.
4. Verify the webhook signature before you mark an order as paid. See Stripe's constructEvent pattern.
5. Do not print the secret key. Tell me what to put in Stripe test mode to try one payment.

This uses the same ticks as the checklist page, saved in this browser.

Related error fixes