Stripe

Use this skill when work touches Stripe payments, subscriptions, webhooks, Stripe.js/React Elements, Stripe CLI testing, API-version upgrades, or the Better Auth Stripe plugin in a TypeScript app.

Snapshot: 2026-10-09. stripe@23.0.0 (2026-10-01, Node >= 20) pins API 2026-09-30.endive. @stripe/stripe-js@10.0.0, @stripe/react-stripe-js@7.0.0. @better-auth/stripe@1.7.7 peers stripe ^18 – ^22 (not 23): use stripe@22.6.2 (pinned 2026-08-26.dahlia) with it. Refresh from source-map.md if versions differ.

Safety (read first)

• Never ask for, accept, echo, or store real card numbers, sk_live_/rk_live_ keys, or whsec_ secrets in chat, files, logs, or commits. Read keys from env only; never print them. Ask the user to set secrets themselves.
• Work in test mode or a sandbox only. Never run write commands, stripe trigger, refunds, or cancellations against live keys. Use only Stripe's published test card numbers, in the user's own sandbox UI.
• Card data must never touch your server: use Checkout, Payment Element, or Stripe.js tokens. Do not build raw-card forms.

Workflow