Accessing Payment Settings
Navigate to Console > Payments > Settings or:- Open the Console sidebar
- Click Payments
- Select Settings
Configuration Interface
The settings page provides a tabbed interface for managing test and live credentials:Test Mode Configuration
Enter Publishable Key
Paste your Stripe test publishable key (starts with
pk_test_).Find this in Stripe Dashboard: Developers > API keysValidate Credentials
Click Validate to verify your keys are correct. The system will:
- Test API connectivity
- Verify key permissions
- Display validation status
Live Mode Configuration
Follow the same steps with your live Stripe keys:- Publishable Key:
pk_live_... - Secret Key:
sk_live_...
Webhook Configuration
Each project has unique webhook URLs that you must register in Stripe:Get Your Webhook URLs
The settings page displays your webhook URLs:| Mode | URL Pattern |
|---|---|
| Test | https://api.devkit4ai.com/api/v1/payments/stripe/webhooks/{project_id}/test |
| Live | https://api.devkit4ai.com/api/v1/payments/stripe/webhooks/{project_id}/live |
Register Webhooks in Stripe
Open Stripe Dashboard
Go to Stripe Dashboard and select Developers > Webhooks.
Select Events
Choose the events to listen for:Required Events:
checkout.session.completedcustomer.subscription.createdcustomer.subscription.updatedcustomer.subscription.deletedinvoice.payment_succeededinvoice.payment_failed
Copy Webhook Secret
After creating the endpoint, reveal and copy the Signing secret (starts with
whsec_).Validation Status
The settings page shows the current validation status for each mode:| Status | Meaning | Action |
|---|---|---|
| ✅ Valid | Credentials verified successfully | Ready to use |
| ⚠️ Not Configured | No credentials entered | Add API keys |
| ❌ Invalid | Credentials failed validation | Check and re-enter keys |
Security Considerations
Encrypted Storage
Encrypted Storage
All Stripe credentials are encrypted using AES-256 before storage. Secret keys are never exposed in API responses or logs.
Per-Project Isolation
Per-Project Isolation
Each project has independent credentials. Compromising one project’s keys doesn’t affect others.
Test/Live Separation
Test/Live Separation
Test and live credentials are stored separately with mode-specific webhook URLs, preventing accidental production charges during development.
Webhook Signature Verification
Webhook Signature Verification
All incoming webhooks are verified using the signing secret to prevent unauthorized event injection.
API Reference
The settings page uses these server actions:| Action | Purpose |
|---|---|
getPaymentConfigAction | Fetch current configuration (keys masked) |
updatePaymentConfigAction | Save new credentials |
validateStripeCredentialsAction | Test credential validity |
getStripeWebhookUrlsAction | Get webhook URL for current project |
Troubleshooting
Validation fails with 'Invalid API key'
Validation fails with 'Invalid API key'
- Verify you’re using the correct key type (test vs live)
- Check for extra whitespace when copying keys
- Ensure the key hasn’t been rolled in Stripe Dashboard
Webhooks not received
Webhooks not received
- Confirm the webhook URL is correctly registered in Stripe
- Check Stripe Dashboard for webhook delivery attempts
- Verify the signing secret matches the endpoint
- Test with Stripe CLI:
stripe listen --forward-to <url>
'Configuration not found' error
'Configuration not found' error
- Ensure you’ve saved the configuration after entering keys
- Check that you’re viewing the correct project
- Verify the project is active

