Integrate Secure Payment Gateways

This skill equips AI assistants to guide developers through secure payment integration workflows for Stripe, PayPal, and Square APIs. It provides best practices, checklists, and actionable steps for building checkout flows, subscription billing, webhook handlers, and error handling while enforcing PCI compliance and security-first patterns.

Use this skill when working on payment integration tasks, implementing checkout flows, setting up subscription billing, handling payment webhooks, or needing guidance on PCI compliance and security best practices for payment processing. Use it when you need verification steps, error handling patterns, or migration paths from test to production environments.

Do not use this skill when the task is unrelated to payment integration or when you need expertise in a different domain or tool outside payment processing scope.

You provide your payment integration goals, constraints, required inputs, and specific implementation needs (checkout flows, webhooks, subscriptions, error scenarios). The skill clarifies requirements and applies relevant best practices.

You receive payment integration code with error handling, webhook endpoint implementations, database schema for payment records, security checklists covering PCI compliance points, test payment scenarios and edge cases, and environment variable configuration. Code includes both server-side and client-side implementations where needed using official SDKs.

Stripe API integration for payment processing, checkout flows, and subscription billing. PayPal API integration for payment operations and webhook handling. Square API integration for payment processing workflows. Webhook signature verification uses official SDK libraries, with Stripe and PayPal including HMAC signatures.

This skill serves developers and payment integration specialists building secure payment processing systems. It's designed for teams implementing checkout flows, subscription billing, or webhook handlers who need to enforce security-first patterns, handle edge cases like failed payments and disputes, and maintain PCI compliance. The skill benefits engineers migrating from test to production environments who need comprehensive validation and real-world failure prevention.

The skill covers Stripe/PayPal/Square API integration, checkout flows and payment forms, subscription billing and recurring payments, webhook handling for payment events, PCI compliance and security best practices, and payment error handling with retry logic.

Security first - never log sensitive card data. Implement idempotency for all payment operations. Handle all edge cases including failed payments, disputes, and refunds. Test mode first, with clear migration path to production. Comprehensive webhook handling for async events.

Webhook security requires signature verification using official SDK libraries, raw body preservation (never modify webhook request body before verification as JSON middleware breaks signature validation), idempotent handlers that store event IDs in your database and check before processing, quick response returning 2xx status within 200ms before expensive operations, and server validation by re-fetching payment status from provider API.

PCI compliance essentials include never handling raw cards (use tokenization APIs like Stripe Elements or PayPal SDK that handle card data in provider's iframe, never store, process, or transmit raw card numbers), server-side validation where all payment verification happens server-side via direct API calls to payment provider, and environment separation where test credentials must fail in production.

Real-world examples from Stripe, PayPal, and OWASP include payment processor collapse during traffic spike causing webhook queue backups and revenue loss, out-of-order webhooks breaking Lambda functions without idempotency leading to production failures, malicious price manipulation on unencrypted payment buttons resulting in fraudulent payments, test cards accepted on live sites due to misconfiguration causing PCI violations, and webhook signature skipped allowing systems to be flooded with malicious requests.