Cursor prompt to integrate Stripe payments
A Stripe integration where fulfillment lives in the webhook, not the redirect, which is the mistake that ships silently. This prompt has Cursor's agent handle raw-body signature verification, idempotent event processing, and a Stripe CLI test run in the terminal, so you review a working listen-and-trigger log alongside the diffs.
Last updated
Integrate Stripe checkout into this backend for a single paid {{resource}}. Three pieces only: a POST /api/checkout route that creates a Checkout Session server side with the price id from an environment variable, a success and cancel page pair, and a POST /api/webhooks/stripe handler. The webhook must verify the stripe-signature header against the raw request body, watch for framework body parsing that consumes it first, and handle checkout.session.completed idempotently so a replayed event never grants access twice. Record fulfillment in {{database}} keyed by the Stripe event id. Never treat the success page redirect as proof of payment, fulfillment happens only in the webhook. Test with the Stripe CLI: run stripe listen in the integrated terminal, trigger a test event, and show me the log line proving the handler fired exactly once. List every changed file when done.Customize it
Runs in your browser. Nothing you type here is sent anywhere.
Integrate Stripe checkout into this backend for a single paid users. Three pieces only: a POST /api/checkout route that creates a Checkout Session server side with the price id from an environment variable, a success and cancel page pair, and a POST /api/webhooks/stripe handler. The webhook must verify the stripe-signature header against the raw request body, watch for framework body parsing that consumes it first, and handle checkout.session.completed idempotently so a replayed event never grants access twice. Record fulfillment in PostgreSQL keyed by the Stripe event id. Never treat the success page redirect as proof of payment, fulfillment happens only in the webhook. Test with the Stripe CLI: run stripe listen in the integrated terminal, trigger a test event, and show me the log line proving the handler fired exactly once. List every changed file when done.
Questions about this prompt
Signature verification keeps failing on the webhook. Why?
Your framework parsed the JSON body before the handler ran, so the raw bytes Stripe signed are gone. The webhook route has to opt out of body parsing. This is the most common failure on this task, which is why the prompt calls it out explicitly.
How do I adapt this for subscriptions instead of one-time payments?
Change the Checkout Session mode to subscription and handle invoice.paid plus customer.subscription.deleted in the same webhook. Keep the event-id idempotency exactly as written, replayed subscription events are just as dangerous.
Can the agent run the Stripe CLI test itself?
It runs stripe listen and stripe trigger in the integrated terminal, but you must complete stripe login in a browser first. Do that once before starting the agent so the verification step does not stall waiting on auth.