Verify webhooks, always
Your webhook endpoint is a public URL, so anyone can POST to it. Without signature verification, an attacker can forge a "payment succeeded" event and unlock paid features for free. Generated code often wires up the handler but skips the verification step.
- Verify the Stripe signature
Use the signing secret to confirm every webhook actually came from Stripe before acting on it.
- Treat the webhook as the source of truth
Grant access and fulfill orders from verified webhook events, not from a client-side success redirect that can be faked.
- Make handlers idempotent
Stripe can deliver an event more than once. Ensure repeat delivery does not double-fulfill or double-charge.
Never trust the client with money
The classic AI-generated payment bug is letting the browser set the price or amount. Anything the client sends can be tampered with - the amount, the plan, the quantity must be decided and validated server-side.
- Set amounts on the server
Look up prices server-side from your own data or Stripe Price IDs; never charge an amount the client supplied.
- Keep the secret key server-side
Only the publishable key belongs in the browser. The secret key must never reach the client.
- Re-check entitlements server-side
Confirm a user actually has an active subscription before serving paid functionality - do not rely on client state.
The pre-launch checklist
- Verify the signature on every webhook
Reject anything not signed with your signing secret.
- Fulfill from verified webhooks, not client redirects
The success page can be faked.
- Make webhook handlers idempotent
Handle duplicate event delivery safely.
- Set prices and amounts server-side
Never charge a client-supplied amount.
- Keep the Stripe secret key server-only
Only the publishable key ships to the browser.
- Re-check entitlements on the server
Confirm active subscriptions before serving paid features.
Run this checklist on your repo, automatically
PeakStack scores every commit for security, scalability, and cost - with the exact line and a fix.
Request accessFAQ
What is the most common Stripe mistake in AI-built apps?
Skipping webhook signature verification. The webhook URL is public, so without verifying the Stripe signature, anyone can forge a "payment succeeded" event and unlock paid features for free.
Can I trust the amount the browser sends to Stripe?
No. Anything from the client can be tampered with. Decide and validate prices, amounts, and quantities server-side using your own data or Stripe Price IDs - never charge a client-supplied amount.
How do I know my Stripe integration is safe?
Confirm webhook signature verification, server-side amount handling, idempotent handlers, and server-side entitlement checks. PeakStack flags unverified webhooks and client-trusted payment logic on every commit.