Call Stripe API from Flutter Securely
Flutter subscription screens without Stripe secrets on device
A Stripe secret key passed with dart-define or kept in Dart source is compiled into the APK or IPA and can be extracted. Ship only a RealComposer client token in the Flutter app. The edge pipeline injects STRIPE_SECRET_KEY and returns plan and status fields for your billing screen.
Why Flutter apps cannot hold Stripe secret keys
Flutter release builds keep string constants and dart-define values readable, even with obfuscation enabled. A leaked secret key allows full account access, so Stripe server calls must come from a trusted backend or edge.
- sk_live_ recovered from APK or IPA string tables
- Full Stripe customer objects parsed on the UI isolate
- Key rotation forcing a new store release
How RealComposer Solves This at the Edge
Store credentials in Secret Vault
Save STRIPE_SECRET_KEY in RealComposer so the value never enters the Flutter project.
Configure the edge pipeline
Add the upstream steps with vault header injection, set allowed origins, and map only the fields the screen binds.
Call the pipeline with package:http
Call your workspace edge URL with a restricted rc_live_ client token.
final res = await http.get(
Uri.parse('https://realcomposer.com/v1/workspace/call-stripe-from-flutter-securely?customerId=$customerId'),
headers: {'Authorization': 'Bearer rc_live_client_token'},
);
final billing = jsonDecode(res.body);
{
"id": "cus_Q2x8Lm",
"object": "customer",
"email": "ada@example.com",
"name": "Ada Lovelace",
"invoice_settings": {
"default_payment_method": "pm_1Pz",
"footer": null
},
"metadata": {
"crm_id": "8812"
},
"subscriptions": {
"object": "list",
"data": [
{
"id": "sub_1Px",
"status": "active",
"current_period_end": 1767225600,
"items": {
"object": "list",
"data": [
{
"price": {
"nickname": "Pro"
}
}
]
}
}
]
}
}
{
"plan": "Pro",
"status": "active",
"renewsAt": 1767225600
}
Recipe Specs
- HTTP method
- GET
- Upstream calls
- 1
- Edge cache TTL
- No caching
- Client auth
- Restricted client token
- Mapped output fields
- 3
- Payload
- 359 B to 54 B (-85%)
curl -X GET "https://realcomposer.com/v1/workspace/call-stripe-from-flutter-securely" \ -H "Authorization: Bearer rc_live_client_token"
Developer Questions & Troubleshooting
Can I use flutter_stripe without a backend?
The flutter_stripe SDK uses your publishable key on device, but creating PaymentIntents and reading subscriptions still needs the secret key on a server or edge pipeline.
Does --obfuscate protect the Stripe key?
No. Obfuscation renames symbols but leaves string values intact, so the key can still be extracted.
Sources & Definitions Used in This Answer
Deploy this Flutter + Stripe Recipe
Clone this pre-configured pipeline into your RealComposer workspace in one click. We pre-populate upstream URLs, headers, and mapping rules.