Payments

Keep Stripe test and live keys apart

Use sk_test_ keys in development and previews and sk_live_ only in production. Each webhook endpoint has its own signing secret.

Why it matters

A test key in production means checkouts succeed but nobody actually pays. A live key in development means test runs charge real cards.

How to fix it

1. Put sk_test_ and pk_test_ in Development and Preview environment variables.
2. Put sk_live_ and pk_live_ only in Production.
3. Create separate webhook endpoints for test and live mode; each has its own whsec_ secret.
4. Make sure secret and publishable keys come from the same mode.

How to verify

• Preview deployments show Stripe's test-mode checkout.
• A small real purchase in production appears in the live dashboard.

Related checks

• Verify the Stripe webhook signature
• Set Vercel environment variables per environment
• Decide prices and access on the server

Tick it off in the full checklist