Payment Security

Your payment system works on the preview in test mode. Before real money flows, you'll secure it and take it live: confirm the defenses, use a restricted Stripe key for production, switch to live keys, and merge to main.

What you'll do

• Audit the payment system for bypasses and leaks.
• Create a restricted Stripe live key scoped to what your app actually uses.
• Switch to live keys, merge to main, and verify a real payment.

1. Audit your payment security

Money makes mistakes expensive, so have Claude review the system against the essentials.

Audit my payment system for security
Review my Stripe + Clerk + Neon payment system for security and fix any gaps:
1.The Stripe webhook **verifies Stripe's signature** on every request, and rejects anything unsigned or tampered with.
2.The webhook is **idempotent** – replaying the same event can't double-grant access or corrupt data.
3.Every premium feature is gated **server-side** (Clerk session + the subscription in Neon) – a logged-out or non-paying user can't reach it even by calling the server directly.
4.All Stripe secrets and the webhook signing secret live in the **Vercel vault**, never in code or the browser.
5.No card data ever touches my server (Stripe Checkout handles it).
Show me what you found and fix it with minimal changes.

Outcome: Your payment system has no obvious bypasses or secret leaks.

I audited and hardened my payment system

2. Create a restricted live key

For production, don't use your full secret key. Stripe lets you create a restricted key scoped to only the things your app does (Checkout, customers, subscriptions, webhooks) – so a leak does far less damage.

Set up a restricted Stripe key for production
Help me prepare Stripe for production safely:
1.Walk me through switching Stripe to live mode and recreating my products/prices there (if needed).
2.Help me create a **restricted live key** scoped to the minimum my app uses (Checkout Sessions, Customers, Subscriptions, Webhooks) – not the full secret key.
3.Store the live keys and the live webhook signing secret in the Vercel vault, for the **Production** environment only (keep test keys for Preview/Development).
Explain what to click in the Stripe dashboard.

Outcome: Production uses a restricted, least-privilege Stripe key, with live secrets in Vercel.

I set up a restricted Stripe key for production

3. Go live

Now take payments to production: point Stripe's live webhook at your domain, merge your payment branch to main, and deploy.

Take payments live
Help me take payments to production:
1.Confirm no secrets are committed and the build is clean.
2.Point Stripe's **live** webhook at my production domain's webhook endpoint.
3.Merge my payment branch into main (and clean up the branch) so Vercel deploys to production.
4.Confirm the deploy is Ready.

Outcome: Your payment system is live on production with live keys.

I took payments live to production

4. Verify a real payment

Do one real end-to-end check on production.

Verify payments work live
Walk me through verifying payments on my live site:
- subscribe with a real card,
- confirm the live webhook fired and Neon recorded the subscription,
- confirm the premium feature unlocked for me,
- confirm I can manage/cancel via the billing portal.
If anything's off, help me fix it. Otherwise – you're taking real payments!

Outcome: A real subscription works end to end in production.

I verified a real payment works in production