How to Add Stripe Checkout to Any App in Under an Hour

Stripe Checkout is a hosted payment page. You create a Session on your server, redirect the customer to it, and Stripe handles the card form, 3D Secure, taxes, and wallets like Apple Pay. No PCI compliance work on your side.

Direct answer: to add Stripe Checkout, call stripe.checkout.sessions.create() with your line items and a success URL, redirect the browser to the returned url, then listen for the checkout.session.completed webhook to grant access. Stripe takes 2.9% plus 30 cents per successful card charge.

What do you need before writing code?

A Stripe account in test mode, your secret key from the dashboard, and an HTTPS endpoint if you want webhooks locally (use the Stripe CLI for that). Node 18+ or Python 3.9+, and one product with a price.

Create the price in the dashboard first rather than passing price_data inline. Inline prices work, but they create a new price object on every call and make revenue reporting a mess later.

npm install stripe

Python projects get the same thing with pip install stripe.

How do you create a Checkout Session?

The server-side call is nine lines:

import stripe
stripe.api_key = os.environ["STRIPE_SECRET_KEY"]

session = stripe.checkout.Session.create(
    mode="payment",
    line_items=[{"price": "price_1Pxyz...", "quantity": 1}],
    success_url="https://yourdomain.com/thanks?sid={CHECKOUT_SESSION_ID}",
    cancel_url="https://yourdomain.com/pricing",
    customer_creation="if_required",
    allow_promotion_codes=True,
)
return {"url": session.url}

Send url to the client and redirect. For subscriptions, change mode to "subscription" and use a recurring price — nothing else changes.

Do not put the secret key in frontend code. It starts with sk_ and must never reach the browser; the publishable key (pk_) is the one that goes into client JS, and Checkout does not even need it.

Why is the webhook the important part?

Users close tabs. Some pay and then hit back. The success_url page is not proof of payment — anyone can load that URL.

Grant access in the webhook, not on the success page:

from stripe import Webhook

event = Webhook.construct_event(
    payload, sig_header, os.environ["STRIPE_WEBHOOK_SECRET"]
)
if event["type"] == "checkout.session.completed":
    s = event["data"]["object"]
    if s["payment_status"] == "paid":
        fulfil(s["id"], s["customer_details"]["email"])

construct_event verifies the signature. Skip it and you have built an endpoint that hands out free products to anyone who can send a POST.

For local development:

stripe listen --forward-to localhost:3000/webhook

That prints a whsec_... secret — different from the dashboard one. Use it in dev, register the production endpoint separately.

Which test cards matter?

Stripe’s test mode accepts any card number that passes Luhn, but four scenarios cover most bugs:

• 4242 4242 4242 4242 — succeeds immediately.
• 4000 0025 0000 3155 — requires 3D Secure authentication.
• 4000 0000 0000 9995 — declines for insufficient funds.
• 4000 0000 0000 0002 — generic decline.

Use any future expiry and any three-digit CVC. The 3DS card is the one that catches broken redirect flows most often.

What does it cost, and when does that hurt?

2.9% + $0.30 for domestic cards in the US. A $10 product loses 5.9% to fees, a $100 product loses 3.2%. For anything under $5, fixed fees dominate and Stripe may not be the right rail at all.

Add 1.5% for international cards, 1% for currency conversion, and 0.8% for Radar’s paid tier if you enable it. Chargebacks are $15 each, refunded if you win.

Which parts are easy to get wrong?

Idempotency. Webhooks retry. Store event.id and skip duplicates, or you will email the customer twice and provision access twice.

Session expiry. Sessions are created with a 24-hour expiry by default. For limited-time offers set expires_at explicitly.

Taxes. Stripe Tax costs 0.5% per transaction. If you sell to EU customers and skip it, you own the compliance problem.

Locale. Pass locale="auto" and Checkout localises currency formatting and payment methods. Skip it and a German customer sees US-only card options.

Who should use something else?

If you need a merchant of record that handles VAT filings for you, Paddle or Lemon Squeezy are simpler — they cost 5% or so and take the tax problem off your desk. If you sell physical goods with complex shipping rules, Shopify’s checkout does more out of the box.

Stripe wins when you want control: custom pricing logic, metered billing, marketplaces with connected accounts.

Key Takeaways

• Checkout needs two endpoints: one to create the Session, one to receive webhooks.
• Never fulfil orders from the success page — verify checkout.session.completed server-side.
• construct_event validates the signature; without it your webhook is a free-goods API.
• Fees are 2.9% + $0.30 domestic, so small-ticket products lose a big share.
• Store webhook event.id values to stay idempotent; Stripe retries for up to three days.