What Stripe Actually Does in Your App
Stripe handles payment processing. When a user clicks "Buy" on your site, they should not be entering credit card numbers into a form you built -- that is both insecure and against Stripe's terms of service. Instead, your app creates a Stripe Checkout Session and redirects the user to Stripe's hosted checkout page. Stripe handles the payment, then sends the user back to your success or cancel URL. Your app receives confirmation that the payment happened via a webhook.
What you build vs what Stripe builds: you build the button that triggers checkout, the success page the user lands on after payment, and the logic that runs after a successful payment. Stripe builds everything in between -- the secure payment form, fraud detection, card processing. This is the correct division of responsibility.
Step 1: Get Your Stripe Keys
Log into your Stripe dashboard. Navigate to Developers then API Keys. You need two keys: the publishable key (used in frontend code, visible to users) and the secret key (used in backend code, must never be exposed publicly). Copy your secret key.
Step 2: Store the Key in Replit Secrets
In Replit, find the Secrets panel (the padlock icon in the left sidebar). Create a secret named STRIPE_SECRET_KEY and paste your key as the value. This stores it securely -- it is available to your code as process.env.STRIPE_SECRET_KEY but never visible in your code files.
Step 3: Ask Claude to Write the Integration
Prompt: "Add Stripe Checkout to my Replit Express app. When the user clicks the Buy button, create a Stripe Checkout Session using price ID [your price ID] and redirect them to the checkout page. On success, redirect to /thank-you. On cancel, redirect back to the main page. My Stripe secret key is stored in process.env.STRIPE_SECRET_KEY."