Stripe payment integration serviceTake card, Apple Pay and Google Pay payments in 3 days.

The Buy button is the easy 10%. The part that decides whether you lose money is everything around it: who sets the price, how your app learns a payment succeeded, and what happens when something goes wrong halfway.

• Prices come from your server. The browser sends which product, never how much. The server looks the price up in Stripe and creates the Checkout Session.
• Webhooks are the source of truth. Your app marks an order as paid when Stripe calls your webhook with checkout.session.completed, not when the buyer lands on your thank-you page.
• Signatures are verified. Every webhook request is checked against your endpoint secret, so nobody can fake a “payment succeeded” call.
• Fulfilment is idempotent. Stripe can send the same event more than once. Each order is fulfilled exactly once, keyed on the session id.
• Delayed payments are handled. Some methods, like bank debits, succeed hours later. Those arrive as checkout.session.async_payment_succeeded.
• Keys live in environment variables. The secret key never ships to the browser or into your repository.

export async function POST(req: Request) {
  // The raw body is required to verify Stripe's signature.
  const body = await req.text();
  const signature = req.headers.get('stripe-signature') ?? '';

  let event: Stripe.Event;
  try {
    event = stripe.webhooks.constructEvent(body, signature, process.env.STRIPE_WEBHOOK_SECRET!);
  } catch {
    return new Response('Invalid signature', { status: 400 });
  }

  if (event.type === 'checkout.session.completed') {
    const session = event.data.object;
    if (session.payment_status === 'paid') {
      // Safe to call twice: fulfilOrder skips sessions it has already handled.
      await fulfilOrder(session.id);
    }
  }
  return new Response('ok');
}

There are two costs: the one-time cost to build it, and Stripe’s fee on every sale. Stripe charges no setup or monthly fee on standard pricing. In the US you pay 2.9% + 30¢ per successful card payment, plus 1.5% for international cards and 1% if currency conversion is needed. Use the calculator above to see your exact numbers.

The build price is fixed because the scope is fixed. If your case needs something outside it, like Stripe Connect for a marketplace, I say so before you pay.

1. 1Fulfilling on the success page. Buyers close tabs, lose signal, or never get redirected. Orders go missing. Fulfil from the webhook instead.
2. 2Trusting the amount from the browser. Anyone can edit a request in their dev tools. Look prices up on the server.
3. 3Skipping signature checks. An unverified webhook endpoint lets anyone mark orders as paid.
4. 4Double fulfilment. Stripe retries webhooks until it gets a 2xx response. Without an idempotency check, customers get two licences or two shipments.
5. 5Parsing the body before verifying. Frameworks that parse JSON automatically break the signature check. The handler needs the raw body.
6. 6Leaving test mode half-live. Test keys in production, or live webhooks pointing at a staging URL, fail silently until a customer complains.

Yes. With Checkout, card details go straight from the customer’s browser to Stripe and never touch your server. That keeps you in the simplest PCI category, SAQ A, which is a short self-assessment rather than an audit.

Your side of security is small but important: keep the secret key server-side, verify webhook signatures, use HTTPS everywhere, and use restricted API keys when a service only needs to read data. All of that is part of the build.

Stripe reviews new accounts before live payouts, so it helps to have these ready. None of them block the build. I can work in test mode while your account is being activated.

• Business details and a bank account for payouts, entered in your Stripe Dashboard.
• Clear product descriptions and prices on your site.
• A refund or cancellation policy and a way to contact you, both visible on your site.
• A statement descriptor, the short name buyers see on their card statement.