Integrate Secure Payment Gateways

This skill acts as a payment integration specialist focused on secure, reliable payment processing: Stripe, PayPal, and Square API integration, checkout flows and payment forms, subscription billing and recurring payments, webhook handling for payment events, PCI compliance and security best practices, and payment error handling and retry logic.

Its approach runs in five steps: security first, never logging sensitive card data; implement idempotency for every payment operation; handle all edge cases such as failed payments, disputes, and refunds; work in test mode first with a clear migration path to production; and build comprehensive webhook handling for asynchronous events.

Its critical requirements are grouped in two areas. For webhook security and idempotency: always verify webhook signatures using official SDK libraries, since Stripe and PayPal include HMAC signatures, and never process an unverified webhook; never modify the raw webhook request body before verification, because JSON middleware breaks signature validation; store event IDs and check them before processing, since providers retry webhooks on failure and don't guarantee single delivery; return a 2xx status within 200ms before expensive operations like database writes or external API calls, because timeouts trigger retries and duplicate processing; and re-fetch payment status from the provider's API rather than trusting the webhook payload or client response alone. For PCI compliance essentials: never handle raw card numbers, using tokenization APIs such as Stripe Elements or the PayPal SDK that keep card data inside the provider's iframe; do all payment verification server-side via direct API calls to the provider; and separate environments so test credentials fail in production, since misconfigured gateways commonly accept test cards on live sites.

It lists real-world failure patterns sourced from Stripe, PayPal, and OWASP: a payment processor collapsing during a traffic spike and backing up the webhook queue with revenue loss, out-of-order webhooks breaking Lambda functions that lack idempotency, malicious price manipulation on unencrypted payment buttons, test cards accepted on live sites from misconfiguration, and a skipped webhook signature check flooding the system with malicious requests.

Use it proactively when implementing payments, billing, or subscription features, or more generally for payment integration tasks or workflows and when you need guidance, best practices, or checklists for payment integration.

Do not use it when the task is unrelated to payment integration, or when you need a different domain or tool outside this scope.

Inputs are the payment providers to integrate (Stripe, PayPal, Square) and the checkout, subscription, or webhook requirements. Outputs are payment integration code with error handling, webhook endpoint implementations, a database schema for payment records, a security checklist covering PCI compliance points, test payment scenarios and edge cases, and environment variable configuration. The skill always uses official SDKs and includes both server-side and client-side code where needed.

It is for backend and full-stack engineers implementing checkout, billing, or subscription payment flows who need webhook security, idempotency, and PCI compliance handled correctly from the start.