Use a hosted checkout so card data never touches your code, decide the price on the server, and confirm the payment from the provider rather than from the browser. Those three rules remove almost every way this goes wrong.
The prompt
Add payments using a hosted checkout page, so card details never reach my code. The price must be decided on the server from my own product data, never read from the request. Confirm the payment using a webhook from the provider, not a redirect back to my site.
| When to use it | Before you take a single real payment. |
|---|---|
| Why it is worded that way | Each clause closes a specific hole. Hosted checkout keeps card data out of your responsibility entirely. Server-side pricing stops someone sending you a different amount, which is trivial to do and impossible to notice afterwards. Webhook confirmation stops someone reaching the success page without paying, which is the failure that quietly gives your product away. |
Why the redirect is not proof of payment
The page the customer lands on after checkout is a URL. Anyone can open it. If that page is what unlocks the download, the download is not protected — it is announced. The provider's webhook is the only thing that knows a payment actually succeeded.
Never trust a price from the browser
If your checkout reads the amount out of the request, someone will send a different one and be entirely within their rights to. The browser says which product. Your server says what it costs.
Test it before you need it
Every provider has a test mode with fake cards. Run one full purchase through it — payment, confirmation, delivery, email — before a real customer does. What breaks is almost never the payment.
The Build Prompt Pack
This is one of 57 prompts, from the phase "Launch, and take money safely". The pack has the rest, each with the same reasoning underneath, plus the research they are built on and a house-rules file you paste in once.
Tools this applies to
| Tool | What it does | Price |
|---|---|---|
| Stripe | Payments and subscriptions. The standard, and integrating it is a matter of asking. | Free, percentage per sale |
| Vercel | Hosting. Puts a project live on a real address with one command. | Free tier |
| Supabase | Database, accounts and file storage in one, with no backend work. | Free tier |
| Resend | Transactional email that actually arrives. | Free tier |
Every tool has its own page with what it costs and who should skip it. Some links are affiliate links.
More prompts like this
The prompt that finds keys your visitors can read
How do you check whether your API keys are visible to visitors in an AI-built app?
The prompt that tells you when your app fails
How do you find out that your app is broken before a customer tells you?