Security Checklist for Stripe Integration in AI-Built Apps

Stripe is the default payment processor for AI-built SaaS apps. The integration looks straightforward — create a checkout session, handle the webhook, grant access. But AI-generated Stripe code consistently skips the security steps that protect your revenue.

10-point security checklist

1. 1.

   Webhook signature verification is implemented

   critical

   Every Stripe webhook endpoint MUST verify the webhook signature using stripe.webhooks.constructEvent() with your webhook signing secret. Without this, anyone can send fake webhook events to your endpoint and grant themselves paid access, trigger refunds, or manipulate subscription state.

2. 2.

   Secret key is server-side only

   critical

   The Stripe secret key (sk_live_...) must only exist in server-side environment variables. Search your codebase for any sk_ prefix in client-side code, NEXT_PUBLIC_ vars, or React components. The publishable key (pk_live_...) is the only key safe for clients.

3. 3.

   Prices are created server-side, not from client input

   critical

   AI-generated checkout flows sometimes accept the price amount from the client: createCheckoutSession({ amount: req.body.amount }). Users can modify this to pay $0.01 for a $99 product. Always reference pre-created Stripe Price IDs, never accept amounts from the client.

4. 4.

   Entitlement checks happen server-side

   high

   After a user "purchases" a subscription, access to premium features must be verified server-side against Stripe subscription status — not based on a client-side flag or localStorage value. Query the Stripe API or your database for the current subscription status on each protected request.

5. 5.

   Webhook endpoint is idempotent

   medium

   Stripe may send the same webhook event multiple times. If your handler grants access on each call, a retry could create duplicate records or trigger multiple emails. Use the event ID to deduplicate: check if you've already processed this event before acting.

6. 6.

   Test keys are not in production

   high

   Verify your production environment uses sk_live_ and pk_live_ keys, not sk_test_ and pk_test_. AI development uses test keys, and they can accidentally end up in production. Test keys create test charges that never actually bill customers.

7. 7.

   Checkout success URL doesn't grant access

   high

   The success_url in Checkout Sessions is a redirect — not a confirmation. AI tools sometimes grant premium access when users land on the success page. An attacker can navigate directly to this URL without paying. Only grant access via the webhook.

8. 8.

   Customer portal is configured

   low

   Stripe Customer Portal allows users to manage subscriptions. Without it, cancellation requests go to your support email. Configure it and link from your app settings page. AI tools often skip this because it requires additional Stripe Dashboard configuration.

9. 9.

   Subscription cancellation removes access

   high

   When a subscription is canceled or payment fails, premium access must be revoked. Handle the customer.subscription.deleted and invoice.payment_failed webhook events. AI tools focus on the happy path (purchase → access) and skip the revocation path.

10. 10.

    No raw Stripe errors exposed to users

    medium

    Stripe API errors can contain internal information (charge IDs, customer IDs, decline reasons with bank details). Catch Stripe errors and return generic messages to the user. Log the full error server-side for debugging.