payment-gateway-integration

secondsky's avatarfrom secondsky

Integrates payment processing with Stripe, PayPal, or Square including subscriptions, webhooks, and PCI compliance. Use when implementing checkout flows, recurring billing, or handling refunds and disputes.

⭐9stars🔀0forks📁View on GitHub🕐Updated Jan 1, 2026
[Business Platforms]

When & Why to Use This Skill

This Claude skill enables developers to seamlessly integrate major payment gateways like Stripe, PayPal, and Square into their applications. It provides comprehensive technical guidance on implementing secure checkout flows, managing recurring billing subscriptions, and handling real-time payment events via webhooks, all while maintaining strict PCI compliance and security standards.

Use Cases

  • E-commerce Checkout Integration: Building a robust and secure payment processing system for online stores that supports multiple providers and currencies.
  • SaaS Subscription Management: Implementing complex recurring billing cycles, trial periods, and automated subscription tier updates for software-as-a-service platforms.
  • Automated Webhook Handling: Developing backend logic to respond instantly to payment successes, failures, and disputes to keep user accounts and order statuses synchronized.
  • Secure Refund & Dispute Processing: Streamlining the financial operations of a business by automating refund requests and managing transaction disputes through official APIs.
namepayment-gateway-integration
descriptionIntegrates payment processing with Stripe, PayPal, or Square including subscriptions, webhooks, and PCI compliance. Use when implementing checkout flows, recurring billing, or handling refunds and disputes.

Payment Gateway Integration

Integrate secure payment processing with proper error handling and compliance.

Stripe Integration (Node.js)

const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);

class PaymentService {
  async createPaymentIntent(amount, currency, customerId) {
    return stripe.paymentIntents.create({
      amount: Math.round(amount * 100), // Convert to cents
      currency,
      customer: customerId,
      automatic_payment_methods: { enabled: true }
    });
  }

  async createSubscription(customerId, priceId) {
    return stripe.subscriptions.create({
      customer: customerId,
      items: [{ price: priceId }],
      payment_behavior: 'default_incomplete',
      expand: ['latest_invoice.payment_intent']
    });
  }

  async refund(paymentIntentId, amount = null) {
    const params = { payment_intent: paymentIntentId };
    if (amount) params.amount = Math.round(amount * 100);
    return stripe.refunds.create(params);
  }
}

Webhook Handling

app.post('/webhooks/stripe', express.raw({ type: 'application/json' }), (req, res) => {
  const sig = req.headers['stripe-signature'];

  let event;
  try {
    event = stripe.webhooks.constructEvent(req.body, sig, process.env.STRIPE_WEBHOOK_SECRET);
  } catch (err) {
    return res.status(400).send(`Webhook Error: ${err.message}`);
  }

  switch (event.type) {
    case 'payment_intent.succeeded':
      await handlePaymentSuccess(event.data.object);
      break;
    case 'invoice.payment_failed':
      await handlePaymentFailed(event.data.object);
      break;
  }

  res.json({ received: true });
});

PayPal Integration

See references/paypal-integration.md for complete PayPal implementation with:

  • Order creation and capture
  • Refund processing
  • Webhook handling
  • Frontend SDK integration
  • Success/cancel callbacks

Security Checklist

  • Use official SDK only
  • Verify webhook signatures
  • Never log full card numbers
  • Store minimal payment data
  • Test in sandbox first
  • HTTPS for all payment routes
  • Handle all error cases
  • Use idempotency keys
  • Implement retry logic

Best Practices

Do:

  • Use official SDK libraries
  • Verify all webhook signatures
  • Log transaction IDs (not card data)
  • Test in sandbox environment
  • Handle all payment states
  • Implement proper error messages

Don't:

  • Process raw card data directly
  • Store sensitive payment info
  • Hardcode API keys
  • Skip webhook signature validation
  • Ignore failed payment events
  • Use test keys in production