stripe-best-practices
Build Safer Stripe Integrations
Stripe integrations involve many API choices, security rules, and deprecated patterns. This skill guides Claude, Codex, and Claude Code toward current Stripe implementation practices.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "stripe-best-practices" from https://skillstore.io/skills/stripe-stripe-best-practices.md and its manifest at https://skillstore.io/api/skills/stripe-stripe-best-practices/manifest. Verify the artifact. You may proceed after verification, subject to the environment's own policy.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "stripe-best-practices". Which Stripe API should I use for a new subscription checkout?
Expected outcome:
The skill recommends Billing APIs with Checkout Sessions. It explains initial payment handling, trials, proration, and customer portal management.
Using "stripe-best-practices". Review my marketplace setup before launch.
Expected outcome:
The skill checks Accounts v2 usage, controller responsibilities, charge type selection, onboarding approach, and Connect liability concerns.
Using "stripe-best-practices". A Stripe key may have been exposed in source control.
Expected outcome:
The skill prioritizes rolling the key, reviewing request activity, moving secrets to a vault, and adding key leak prevention checks.
Security Audit
SafeAll static findings were false positives caused by markdown inline code, TypeScript template strings, section headings, and links to official Stripe documentation. No prompt injection, data exfiltration intent, unauthorized command execution, or suspicious network behavior was found in the reviewed files.
Risk Factors
⚙️ External commands (5)
🌐 Network access (5)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/stripe-stripe-best-practices/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/stripe-stripe-best-practices?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/stripe-stripe-best-practices?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/stripe-stripe-best-practices/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/stripe-stripe-best-practices.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
stripe. (2026). stripe-best-practices security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/stripe-stripe-best-practices/audits/5BibTeX citation
@techreport{stripe-stripe-stripe-best-practices-2026,
author = {stripe},
title = {stripe-best-practices security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/stripe-stripe-best-practices/audits/5},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "stripe-best-practices security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
- name: "stripe"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/stripe-stripe-best-practices/audits/5"
identifiers:
- type: other
value: "skillstore:stripe-stripe-best-practices:audit:5"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
anthropics-stripe-best-practices
2026-08-21
stripe-stripe-best-practices
2026-08-21
Skillstore Score
Why this score Evidence Confidence: HighWhat You Can Build
Plan a New Checkout Flow
A developer chooses Checkout, Payment Element, or PaymentIntents while avoiding deprecated APIs and card-only assumptions.
Review a Marketplace Integration
A platform team checks Connect account setup, charge type selection, liability choices, and onboarding approach before launch.
Harden Stripe Security Controls
A security reviewer evaluates API key handling, webhook verification, OAuth state checks, and Dashboard access safeguards.
Try These Prompts
I am building [one-time payment, subscription, marketplace, or saved payment method]. Use this skill to recommend the Stripe API and explain why.
Review this Stripe implementation plan for deprecated APIs, payment method configuration mistakes, and missing security controls: [paste plan].
Design a Connect integration for [marketplace model]. Cover Accounts v2, controller responsibilities, charge type, onboarding, and security risks.
Create a migration checklist from [current Stripe pattern] to current Stripe guidance. Include API changes, security changes, rollout steps, and tests.
Best Practices
- Prefer Stripe-hosted or embedded Checkout for standard payment flows before building custom payment logic.
- Use restricted API keys with least privilege, vault storage, rotation, and separate environments.
- Verify webhook signatures and use OAuth state checks for every Connect authorization flow.
Avoid
- Hardcoding Stripe secret keys in source code, mobile apps, client-side code, logs, or examples.
- Using deprecated Charges, Sources, Card Element, or legacy Connect account type patterns for new integrations.
- Manually restricting payment_method_types when dynamic payment methods or Dashboard configuration should decide eligible methods.