01
Sandbox
Have successful, cancelled, failed, refunded, and disputed payments been exercised in a Stripe sandbox?
One successful test card covers only the easiest path.
Free Lovable Stripe production checklist
Move from Stripe sandbox to live payments without guessing.
Review 13 payment, webhook, subscription, entitlement, and live-mode checks. Get your highest-risk gaps in the order to fix them.
✓ Sandbox-to-live path✓ Subscription-aware✓ No Stripe credentials
0 of 13 answered
02
KeysLaunch blocker
Are secret keys server-side, publishable keys client-side, and all values supplied through protected environment settings?
A secret key in source or browser code compromises the account.
03
FulfillmentLaunch blocker
Is paid access granted from verified server-side Stripe data rather than URL parameters or the success page?
A customer can navigate to a success URL without completing payment.
04
WebhooksLaunch blocker
Does the webhook verify Stripe’s signature with the endpoint-specific signing secret?
Unsigned requests can forge payment and subscription events.
05
Webhooks
Can duplicate or reordered webhook deliveries be processed safely?
Stripe retries events and delivery order is not a fulfillment guarantee.
06
SubscriptionsLaunch blocker
Are checkout completion, subscription updates/deletion, refunds, and disputes handled asynchronously?
Recurring access changes after the first checkout.
07
OwnershipLaunch blocker
Is every purchase bound to the authenticated customer and intended app or entitlement?
A valid session must not unlock another user or unrelated project.
08
Customer care
Can customers update payment details and cancel recurring access without confusion?
Subscription products need an operable cancellation and billing-management path.
09
Customer care
Do refunds, disputes, failed renewals, and cancellation produce the promised access outcome?
Financial state and product access can drift apart.
10
Live modeLaunch blocker
Is a separate live webhook endpoint registered and using its live signing secret?
Stripe test and live endpoints and signing secrets are separate.
11
Live modeLaunch blocker
Have sandbox keys been replaced with live keys only in the production environment?
Switching keys is required but should not contaminate development or expose secrets.
12
Live mode
Has one controlled low-value real transaction been completed, verified, refunded, and reconciled?
A sandbox cannot confirm every production account, tax, bank, domain, and webhook setting.
13
Trust
Do checkout and policies clearly state price, recurrence, tax treatment, cancellation, refund, and support contact?
Billing promises must match actual Stripe and entitlement behavior.
Focused guidance
A successful checkout is only the start of payment correctness.
A success URL is not proof of payment; fulfillment must use verified Stripe data.
Refunds, disputes, renewals, and cancellation arrive after Checkout through lifecycle events.
Keys, endpoints, signing secrets, data, and acceptance testing must be handled deliberately per environment.
A focused self-assessment is not proof, certification, or a substitute for the complete evidence-based inspection.