Skip to content

Production checklist

  • Secret keys only run in backends.
  • Publishable keys only include required origins.
  • Unused keys are revoked.
  • Expiration is configured when appropriate.
  • successUrl and cancelUrl belong to an allowed origin.
  • idempotencyKey is sent for each purchase attempt.
  • Terms and required waivers are accepted.
  • 4xx/5xx and 429 errors are handled.
  • Tested in Chrome, Safari, and Firefox.
  • Theme reviewed with CSS variables.
  • Flow tested with a real test publishable key.
  • Stripe webhook is configured in WODira to confirm orders.