Stripe Integration

Select PAYMENT_PROVIDER=stripe, configure an API key through STRIPE_SECRET_KEY or the supported admin integration, and set STRIPE_WEBHOOK_SECRET for webhook verification.

For the unchanged template lifetime variant, STRIPE_VIBEKIT_PRICE_ID maps the seed variant to a Stripe price. Saved admin pricing overrides the seed: link its product/price IDs and ensure amount, currency and interval match the Stripe catalog.

Local webhook testing

With Stripe CLI already installed and authorized for a test account:

stripe listen --forward-to localhost:3000/api/webhooks/stripe

Copy the listener's signing secret into the local STRIPE_WEBHOOK_SECRET, then restart the app if needed. Complete a test checkout initiated by VibeKit so its trusted team and plan metadata are present. A generic stripe trigger checkout.session.completed fixture does not by itself prove that the app can fulfill its own checkout.

Event handling

The route apps/web/app/api/webhooks/stripe/route.ts invokes the Stripe adapter. It verifies the raw request signature before handling paid checkout.session.completed, checkout.session.async_payment_succeeded and customer.subscription.* events. Missing signing configuration returns 500; invalid signatures return 400. Unsupported event types are acknowledged without fulfillment.

Checkout redirects do not grant access. Verify the resulting team entitlement and payment record, and replay an event to test deduplication. Keep webhook secrets separate from API keys and use the final site origin for deployed endpoints.

See One-Time Purchases.