Ship It Checklist

Checklists /Replit /Payments

High

Use test keys until the published app is ready

It is easy to put a live Stripe secret into the development workspace and take a real card by accident. Use test keys until the published app, the webhook, and the amount are all checked. Then set live keys only on the published app.

How to check

  1. In Stripe, confirm you are looking at test mode.
  2. The published app should use a secret that starts with sk_test until you deliberately switch.
  3. The webhook endpoint should be the published URL, and its signing secret should be the one Stripe shows for that endpoint.
  4. Run one test card payment. The Stripe payment should show the amount you expect.

Prompt

Fix prompt
Paste into Cursor or Claude Code
You are working in this repository. Do not add features.

Goal: Stripe keys come from environment variables, checkout amounts are chosen on the server, and webhooks verify the Stripe-Signature header.

Steps:
1. Remove any hard-coded Stripe keys.
2. Create the Checkout Session on the server using a price id.
3. Verify webhook signatures with the endpoint secret before updating an order.
4. Document STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET and the publishable key name.
5. Do not print secret values. Tell me to keep test keys in place until I say otherwise.

This uses the same ticks as the checklist page, saved in this browser.

Related error fixes