Paddle client-side tokens are built for Paddle.js in the browser, while Paddle API keys and webhook secret keys are server-only. Provision access only after a verified webhook, never from a checkout completion event fired in the browser.
Initializes Paddle.js to open checkouts. Cannot read or modify account data.
Reads and modifies customers, subscriptions, prices, and transactions.
Verifies the Paddle-Signature header on webhook deliveries.
Compute the HMAC over the timestamp and raw body with your secret key and reject stale or mismatched signatures.
Let Paddle resolve pricing, tax, and currency from catalog IDs defined in your dashboard.
Store the Paddle customer ID against your user record from verified webhooks and look it up server-side for portal or subscription calls.
The API key can cancel subscriptions and issue refunds. Only the client-side token belongs in the browser.
Client events can be faked from DevTools. Wait for transaction.completed or subscription.activated on your server.
An attacker can swap IDs to read another customer. Derive the Paddle customer from the authenticated session.
Keep PADDLE_API_KEY in the Secret Vault and build a pipeline that fetches the subscription for the signed-in user. The client token stays in the browser for checkout, and the edge URL returns a slim plan and status object.
No. It is designed to be public and only opens checkouts. Rotate it if abused, but it cannot read or change account data.
You should not store Paddle credentials in React client code. Proxy Paddle Billing API with restricted client tokens and vault-held API keys. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
You should not store Paddle credentials in FlutterFlow client code. Paddle customer and subscription fetches without APK secret scanning risk. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
To merge paddle subscriptions with stripe payment history, use one RealComposer pipeline with parallel steps. Paddle subscription status and Stripe invoices in single client request. Your React / Flutter / Mobile app makes one request instead of several sequential upstream calls.
To combine paddle and supabase billing dashboard, use one RealComposer pipeline with parallel steps. Supabase user row and Paddle subscription merged for account screens. Your FlutterFlow app makes one request instead of several sequential upstream calls.
Retool apps hit CORS and credential limits when calling Paddle. Retool queries RealComposer for Paddle write operations. Use one RealComposer edge URL with OPTIONS handling, client tokens, and vault injection.
Any Frontend / Mobile apps hit CORS and credential limits when calling Paddle and Supabase. Edge receives Paddle webhook and updates Supabase in one flow. Use one RealComposer edge URL with OPTIONS handling, client tokens, and vault injection.
Webhook signature verification is validating that an incoming webhook was sent by the expected provider and was not altered. Providers sign each payload with a shared secret, typically using HMAC-SHA256, and your endpoint recomputes the signature and compares it before trusting the event.
API KeyAn API key is a unique secret string that identifies the application calling an API and authorizes its access. Providers use keys to authenticate requests, enforce quotas, and bill usage. Anyone holding the key can act as your application, so secret keys must stay on trusted servers.
HMAC AuthenticationHMAC authentication uses a hash-based message authentication code, computed from a message and a shared secret key, to prove that a request came from a holder of the secret and was not modified. The receiver recomputes the HMAC and compares it to the value sent.