Business & growth
What is a stripe integration?
A stripe integration is the connection between your application and Stripe that lets it charge customers, handle subscriptions, and confirm payments without your app ever touching card details.
New to Bolt? Sign up free.
Technical definition
A Stripe integration connects an application to Stripe's payment APIs. The standard flow uses a hosted checkout or a client-side element to collect card details, so sensitive data goes to Stripe rather than to your server, which keeps the application outside most of the PCI compliance burden.
The components:
- Publishable key: used in frontend code to initialize checkout. Safe to expose.
- Secret key: used server-side to create charges and manage objects. Never exposed.
- Webhook endpoint: receives event notifications from Stripe, such as a completed payment, with a signature you verify.
In plain terms
A Stripe integration is how your app takes money.
The card details never come to you. Stripe collects them, processes the payment, and tells your app what happened.
Why it matters
Taking payment is the point at which a project becomes a business, and it is the step most self-built apps stop short of.
Three things account for most of the trouble.
The secret key must stay server-side. A secret key in browser code lets anyone issue refunds and read your customer data. It is the single most damaging thing to get wrong, and it is easy to do by accident.
Payment confirmation belongs on the webhook, not on the customer returning to a success page. Customers close tabs. If your app marks an order paid only when someone lands on the thank-you page, you will have paid orders that never got fulfilled.
And the webhook needs its signature verified. The URL is reachable by anyone, so an unverified endpoint will accept a forged payment event.
