RealComposer
START FREE
Upstream APIsOfficial Stripe docs

Stripe Safe & Unsafe Practices

Direct Answer

Only Stripe publishable keys (pk_) may ship to browsers or mobile apps. Secret keys (sk_), restricted keys (rk_), and webhook signing secrets (whsec_) must stay on a server or edge proxy. Amounts, prices, and fulfillment decisions belong on the server, driven by verified webhooks.

Credentials & Where They Belong

Client safe
Publishable key (pk_live_, pk_test_)

Identifies your account to Stripe.js and mobile SDKs. Cannot create charges on its own.

Server only
Secret key (sk_live_, sk_test_)

Full API access to your account, including refunds, payouts, and customer data.

Server only
Restricted key (rk_live_)

Scoped secret key. Safer than sk_ for integrations, but still a server credential.

Server only
Webhook signing secret (whsec_)

Used to verify the Stripe-Signature header on incoming events.

Safe Practices

  • Use restricted keys with minimal permissions

    Create an rk_ key that can only read customers or create Checkout Sessions instead of handing every integration a full sk_ key.

  • Create Checkout Sessions and PaymentIntents server-side

    Look up the Price ID on the server and pass only that to Stripe. The client receives a session URL or client secret, never a price it can edit.

  • Verify every webhook signature against the raw body

    Use constructEvent (or constructEventAsync on Workers) with the unparsed request body and whsec_ secret before trusting an event.

  • Send idempotency keys on POST requests

    Retries after timeouts should never create duplicate charges, customers, or subscriptions.

Unsafe Practices

  • Shipping sk_live_ in a mobile, FlutterFlow, or React bundle

    Bundles and binaries are trivially decompiled. A leaked secret key lets attackers issue refunds, read customers, and create charges.

  • Trusting amounts or prices sent by the client

    A user can edit the request and pay one cent. Always resolve pricing from Price IDs on the server.

  • Fulfilling orders from the success redirect

    The success_url can be visited without paying. Grant access only after a verified checkout.session.completed or invoice.paid webhook.

  • Logging full webhook payloads or customer objects

    Events contain emails, addresses, and billing details. Log event IDs and types only.

The RealComposer Pattern

Store STRIPE_SECRET_KEY (or a restricted key) in the RealComposer Secret Vault and reference it as {{secrets.STRIPE_SECRET_KEY}} in a pipeline step. Clients call the edge URL with a revocable rc_live_ client token, and the Payload Slimmer returns only the subscription status or invoice fields the UI renders.

START BUILDING FREE

Frequently Asked Questions

Q:Is it safe to put the Stripe publishable key in my frontend?

Yes. Publishable keys are designed for clients. They can tokenize cards and confirm payments the server prepared, but cannot read data or move money on their own.

Q:Can I call the Stripe API directly from FlutterFlow?

Only with the publishable key. Anything that needs sk_ or rk_ must run through a server or edge proxy that injects the key outside the app binary.

Stripe Recipes

All Stripe recipes (15)
FlutterFlowStripe
Security & Secret Vault

How to Call Stripe API from FlutterFlow Securely Without Exposing Secret Key

To call the Stripe API from FlutterFlow securely, never place your Stripe Secret Key (sk_live_...) inside FlutterFlow API call headers or variables. Instead, store your secret in RealComposer Secret Vault and make your FlutterFlow API call to RealComposer edge URL with a restricted client token. RealComposer automatically injects your Stripe Secret Key server-side on Cloudflare Workers, keeping your key 100% invisible to client decompilation.

Sub-10ms edgeView Recipe
Frontend / WebStripe
Multi-API Aggregation

Combine Stripe Customer and Invoices into Single REST Call

To solve combine stripe customer and invoices into single rest call, never execute unauthenticated requests or embed private tokens directly in client bundles. RealComposer acts as a sub-10ms edge gateway running on Cloudflare Workers that securely injects credentials from your Secret Vault, normalizes responses, and prevents unauthorized API usage. Route calls through your RealComposer edge URL to guarantee complete privacy, robust origin validation, and low mobile latency.

Sub-10ms edgeView Recipe

Related Concepts

API Key

An API key is a unique secret string that identifies the application calling an API and authorizes its access. Providers use keys to authenticate requests, enforce quotas, and bill usage. Anyone holding the key can act as your application, so secret keys must stay on trusted servers.

Webhook Signature Verification

Webhook signature verification is validating that an incoming webhook was sent by the expected provider and was not altered. Providers sign each payload with a shared secret, typically using HMAC-SHA256, and your endpoint recomputes the signature and compares it before trusting the event.

Idempotency in APIs

Idempotency means that performing the same API operation multiple times has the same effect as performing it once. Idempotent endpoints let clients and gateways safely retry requests after timeouts without creating duplicate orders, charges, or records.

Edge Secret Injection

Edge Secret Injection is a security pattern where sensitive upstream API credentials (e.g. Stripe Secret Keys, OpenAI Tokens) are stored in an encrypted vault and injected into HTTP request headers exclusively at the edge runtime, ensuring client browsers and mobile apps never see or store the keys.