A safe payment travels from the customer’s browser to your protected server, then to Stripe Checkout; a signed webhook brings the trusted result back.

The publishable key may appear in the browser, but the secret API key and webhook secret stay on the server and never go into AI chat.

Your server looks up the real price and asks Stripe’s Checkout Sessions API to create one temporary checkout journey.

Stripe’s hosted test page collects and validates the payment details, so your app does not handle raw card numbers.

The success page is not proof. Verify Stripe’s signed webhook, mark the matching order paid once, and only then deliver the purchase.