Skip to main content
Zee Academy · Lesson 14 · Forms and Payments: Server Actions and Stripe

Stripe Checkout: Secure Card Payments and Webhooks

How to accept card payments (Visa, Mastercard, Apple Pay, Google Pay) without handling sensitive card data yourself.

Next lesson

What you will learn

  • PCI compliance: never store card numbers yourself. Stripe keeps them in its own certified vault.
  • Stripe Checkout: a ready-made, optimised payment page that supports Apple Pay and Google Pay.
  • Webhooks: server-to-server notifications Stripe sends to your site when a payment succeeds.
  • Test mode: Stripe lets you simulate every scenario with test cards (e.g. 4242 4242...).

The payment flow

1. The customer clicks "Pay" -> 2. Your server creates a Checkout Session -> 3. The customer pays on Stripe's secure page -> 4. Stripe sends a webhook to your /api/webhooks/stripe -> 5. The database marks the order as paid.

Step by step

  1. Install the official Stripe package

    npm install stripe

    The server-side SDK for creating orders and checking payments.

Tip from practice

Never mark an order as paid just because the browser was redirected to /success?status=paid. Anyone can type that URL by hand. The reliable confirmation is a Stripe webhook whose signature you verify with your STRIPE_WEBHOOK_SECRET.