Production checklist
- Secret keys only run in backends.
- Publishable keys only include required origins.
- Unused keys are revoked.
- Expiration is configured when appropriate.
Checkout
Section titled “Checkout”-
successUrlandcancelUrlbelong to an allowed origin. -
idempotencyKeyis sent for each purchase attempt. - Terms and required waivers are accepted.
- 4xx/5xx and 429 errors are handled.
UI Components
Section titled “UI Components”- Tested in Chrome, Safari, and Firefox.
- Theme reviewed with CSS variables.
- Flow tested with a real test publishable key.
- Stripe webhook is configured in WODira to confirm orders.