Stripe payments
Guardrails, skills, loops, hooks & review agents for database + website builders on Claude Code (Next.js + Supabase).
npx -y skills add m-binimran/dev-pack --skill stripe-paymentsAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Integrate Stripe payments in Next.js — Checkout/Payment Intents, webhooks with signature verification and idempotency, and reconciling state to the database. Use when adding payments, subscriptions, or one-off charges.
SKILL.md
1.7 KB, as published. Nobody here has run it
stripe-payments
Money is the highest-stakes path. The webhook — not the browser redirect — is the source of truth.
Process
- Create the session server-side (Checkout Session or Payment Intent) in a route handler/action. Pass a
stable reference (user id, order id) in
metadata. Never set prices from client input — look them up server-side. - The browser redirect is a hint, not a fact. Don't grant access on the success URL alone.
- Webhooks are the source of truth: a route handler that verifies the signature with the webhook
secret, then updates the DB (
checkout.session.completed,invoice.paid, etc.). - Idempotency: webhooks retry. Record processed event ids and ignore duplicates; make DB updates idempotent.
- Reconcile to your DB: subscription status, entitlements, order state — driven by webhook events, not client calls.
Output
- The session-creation handler, the signature-verified webhook handler, the idempotency guard, and the DB updates each event triggers.
Guardrails
- Verify every webhook signature. An unverified webhook endpoint is a way to grant yourself free product.
- Stripe secret + webhook secret are server-only secrets (the
secret-scanhook blocks them in client code). - Use Stripe test mode keys in dev; never run real charges while building.
- Read the raw request body for signature verification (don't let a framework parse it first).