payment-integration skill

Overview

This skill helps implement secure, reliable payment processing with Stripe, PayPal, and other processors. It covers checkout flows, subscriptions, webhook handling, and PCI-focused security guidance. Use it proactively when building payments, billing, or subscription features to reduce risk and speed deployment.

How this skill works

The skill provides server-side and client-side integration patterns using official SDKs, with example checkout code, subscription flows, and webhook endpoints. It outlines idempotency and retry logic, gives database schemas for payment records, and supplies a security checklist for PCI compliance. Test-mode strategies and a clear path to production are included to simplify migration.

When to use it

• Adding card or wallet payments to a storefront or app
• Implementing subscription billing and recurring charges
• Building reliable webhook handlers for async payment events
• Designing refund, dispute, and retry flows
• Auditing or improving PCI-related security controls

Best practices

• Always use official SDKs and maintain server-side secret handling
• Never log raw card data; use tokenization and PCI scope reduction
• Implement idempotency keys for charge and subscription operations
• Design comprehensive webhook handlers with signature verification and retries
• Keep test and production environments separate and document migration steps

Example use cases

• One-time checkout flow with client tokenization and server-side charge creation
• Subscription sign-up: create customer, attach payment method, start recurring billing
• Webhook processor: validate signatures, update DB, handle invoice.payment_failed and charge.refunded events
• Retry strategy: detect soft failures, schedule exponential retry, notify users on permanent failures
• Security checklist: environment secret management, TLS, limited PCI scope, regular audits

FAQ