stripe-best-practices
Guides Stripe integration decisions — API selection (Checkout Sessions vs PaymentIntents), Connect platform setup (Accounts v2, controller properties), billing/subscriptions, Treasury financial accounts, integration surfaces (Checkout, Payment Element), migrating from deprecated Stripe APIs, and security best practices (API key management, restricted keys, webhooks, OAuth). Use when building, modifying, or reviewing any Stripe integration — including accepting payments, building marketplaces, integrating Stripe, processing payments, setting up subscriptions, creating connected accounts, or implementing secure key handling.
95
—
Does it follow best practices?
Impact
100%
1.42xAverage score across 3 eval scenarios
Advisory
Suggest reviewing before use
Evaluation results
100%
20%Stripe Checkout Integration for Physical Goods Store
Stripe Checkout Session one-time payment integration
Checkout Sessions used
100%
100%
No payment_method_types
100%
100%
No Charges API
100%
100%
No Card Element
100%
100%
Latest API version
0%
100%
mode: payment set
100%
100%
success_url and cancel_url
100%
100%
No payment_method_configurations misuse
100%
100%
Key from environment
100%
100%
Restricted key recommended
0%
100%
100%
58%Freelancer Marketplace — Seller Onboarding and Payment Routing
Stripe Connect marketplace seller onboarding and payment routing
Accounts v2 endpoint
0%
100%
No deprecated type field
0%
100%
configuration.recipient used
0%
100%
Capability status field
0%
100%
dashboard: 'express' set
0%
100%
notification_banner referenced
0%
100%
Embedded onboarding used
100%
100%
Correct fee pattern
100%
100%
No application_fee_amount on transfers
100%
100%
Webhook handler present
100%
100%
Webhook signature verification
100%
100%
100%
10%Secure Stripe Integration Setup
Stripe API key security setup and webhook handler
Recommend RAKs over secret keys
100%
100%
Secrets vault storage
100%
100%
Separate keys per environment
100%
100%
Pre-commit hook for key detection
100%
100%
Principle of least privilege
100%
100%
IP allowlist on API keys
0%
100%
Webhook signature verification present
100%
100%
No processing before verification
100%
100%
No hardcoded API keys
100%
100%
No logging of sensitive data
100%
100%
- Evaluated
- Agent
- Claude Code
- Model
- Claude Sonnet 4.6
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.