Production Stripe Setup Guide¶

Week 5 Day 3 - Phase 4¶

Date: October 24, 2025 Version: 20251024.08:00 Purpose: Configure Stripe for production payments

Overview¶

This guide walks through setting up CodeSlick's production Stripe integration to accept real payments for TEAM (€99/month) and ENTERPRISE (€299/month) subscriptions.

Estimated Time: 2-3 hours Prerequisites: Stripe account with business verification complete

Part 1: Stripe Account Setup¶

1.1 Create Production Stripe Account¶

If you already have a Stripe account: 1. Log in to https://dashboard.stripe.com 2. Switch to Live mode (toggle in top-right) 3. Complete business verification if prompted

If you need a new account: 1. Go to https://stripe.com/register 2. Create account with business email 3. Complete business information: - Legal business name - Business address - Tax ID (VAT number for EU) - Bank account for payouts 4. Verify email and phone number 5. Complete identity verification (upload ID)

Business Verification Status: - ⏳ Pending: May take 1-3 business days - ✅ Approved: Can accept live payments - ❌ Rejected: Contact Stripe support

1.2 Configure Account Settings¶

Navigate to Settings > Account details
Set Business name: "CodeSlick" (or your legal entity)
Set Support email: support@codeslick.dev
Set Customer facing name: "CodeSlick Security Platform"
Navigate to Settings > Branding
Upload logo (square, 512x512px minimum)
Set brand color: #4F46E5 (indigo-600)
Set icon: CodeSlick favicon
Navigate to Settings > Customer emails
✅ Enable "Successful payments"
✅ Enable "Refunds"
✅ Enable "Disputes"
✅ Enable "Invoices"

Part 2: Create Products and Prices¶

2.1 TEAM Plan Product¶

Navigate to Products > Add product
Fill in details:
Name: CodeSlick TEAM

Description:

Professional security analysis for development teams.
- Unlimited PR analyses
- 5 repositories
- Priority support
- Advanced analytics

Image: Upload product image (optional)
Create recurring price:
Price: €99.00
Billing period: Monthly
Currency: EUR
Price ID: Will be auto-generated (e.g., price_1ABC...)
Tax behavior: Exclusive (tax calculated at checkout)
Save product
Copy Price ID (starts with price_) - you'll need this for environment variables

2.2 ENTERPRISE Plan Product¶

Navigate to Products > Add product
Fill in details:
Name: CodeSlick ENTERPRISE

Description:

Enterprise-grade security for large teams.
- Everything in TEAM
- Unlimited repositories
- Unlimited team members
- Custom security rules
- Dedicated support
- SLA guarantees

Create recurring price:
Price: €299.00
Billing period: Monthly
Currency: EUR
Price ID: Will be auto-generated (e.g., price_1DEF...)
Save product
Copy Price ID - you'll need this for environment variables

2.3 Verify Products¶

Navigate to Products and confirm: - ✅ CodeSlick TEAM: €99/month, recurring - ✅ CodeSlick ENTERPRISE: €299/month, recurring - Both products show as "Active"

Part 3: API Keys Configuration¶

3.1 Get Live API Keys¶

Navigate to Developers > API keys
Switch to Live mode (toggle at top)
Find your keys:
Publishable key: pk_live_... (visible)
Secret key: Click Reveal live key → sk_live_... (keep secret!)

Security Warning: - ⚠️ NEVER commit sk_live_ keys to git - ⚠️ NEVER share secret keys - ⚠️ Store only in environment variables

3.2 Update Environment Variables¶

Update your .env.local (for local testing) and Vercel environment variables (for production):

# Stripe Live Keys (PRODUCTION)
STRIPE_SECRET_KEY=sk_live_XXXXXXXXXXXXXXXXXXXXXX
STRIPE_WEBHOOK_SECRET=whsec_XXXXXXXXXXXXXXXXXXXXXX  # We'll get this in Part 4
STRIPE_PRICE_ID_TEAM=price_XXXXXXXXXXXXXXXXXXXXXX
STRIPE_PRICE_ID_ENTERPRISE=price_XXXXXXXXXXXXXXXXXXXXXX

# Public key (safe to expose)
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_live_XXXXXXXXXXXXXXXXXXXXXX

# App URL (production domain)
NEXT_PUBLIC_APP_URL=https://codeslick.dev

3.3 Configure Vercel Environment Variables¶

Go to Vercel Dashboard → Your Project → Settings → Environment Variables
Add each variable:
Name: STRIPE_SECRET_KEY
Value: sk_live_...
Environment: Production (only)
Save
Repeat for all Stripe variables
DO NOT add live keys to Preview or Development environments

Part 4: Webhook Configuration¶

4.1 Create Webhook Endpoint¶

Navigate to Developers > Webhooks
Click Add endpoint
Fill in details:
Endpoint URL: https://codeslick.dev/api/billing/webhook
Description: "CodeSlick production billing webhooks"
Version: Latest API version (2025-09-30)

Select events to listen to:

✅ checkout.session.completed
✅ customer.subscription.updated
✅ customer.subscription.deleted
✅ invoice.paid
✅ invoice.payment_failed

Click Add endpoint

4.2 Get Webhook Signing Secret¶

After creating the endpoint, click on it
Scroll to Signing secret
Click Reveal → Copy the secret (starts with whsec_)

Add to environment variables:

STRIPE_WEBHOOK_SECRET=whsec_XXXXXXXXXXXXXXXXXXXXXX

Update in Vercel:
Go to Vercel → Settings → Environment Variables
Add STRIPE_WEBHOOK_SECRET
Value: whsec_...
Environment: Production
Save

4.3 Test Webhook Endpoint¶

In Stripe Dashboard → Webhooks → Your endpoint
Click Send test webhook
Select event: checkout.session.completed
Click Send test webhook
Check response:
✅ Status: 200 OK
✅ Response time: <2s
❌ If failed: Check Vercel logs for errors

Common Issues: - 401 Unauthorized: Check webhook secret is correct - 500 Internal Server Error: Check database connection - Timeout: Check if endpoint URL is correct

Part 5: Customer Portal Configuration¶

5.1 Configure Customer Portal¶

Navigate to Settings > Customer portal
Enable customer portal:
✅ Enable customer portal
Configure portal settings:
Headline: "Manage your CodeSlick subscription"
Privacy policy: https://codeslick.dev/privacy
Terms of service: https://codeslick.dev/terms
Enable features:
✅ Update payment method
✅ View invoice history
✅ Cancel subscription
⬜ Update subscription (disable for now)
Save changes

5.2 Configure Cancellation Flow¶

In Customer Portal settings → Subscription cancellation
Set cancellation type:
✅ Cancel at period end (recommended)
⬜ Cancel immediately
Add cancellation survey (optional):
"Why are you canceling?"
Options:
- Too expensive
- Not using it enough
- Switched to competitor
- Missing features
- Other
Save

Part 6: Payment Methods Configuration¶

6.1 Enable Payment Methods¶

Navigate to Settings > Payment methods
Enable methods:
✅ Cards (Visa, Mastercard, Amex)
✅ SEPA Direct Debit (for EU customers)
✅ iDEAL (for Netherlands)
⬜ Google Pay (optional)
⬜ Apple Pay (optional)
Configure card settings:
✅ Require CVV
✅ Require postal code
✅ Enable 3D Secure (SCA compliance)
Save

6.2 Configure Billing Settings¶

Navigate to Settings > Billing
Set retry logic for failed payments:
1^st retry: 3 days after failure
2^nd retry: 7 days after failure
3^rd retry: 10 days after failure
After 3 failures: Cancel subscription
Email notifications:
✅ Send email on payment failure
✅ Send reminder before retry
✅ Send email before cancellation
Save

Part 7: Tax Configuration (EU VAT)¶

7.1 Enable Stripe Tax¶

Navigate to Settings > Tax
Click Enable Stripe Tax
Confirm your business location
Stripe Tax will automatically:
Calculate VAT for EU customers
Collect tax ID numbers
Generate tax reports

7.2 Configure Tax Settings¶

Tax collection:
✅ Collect tax IDs from customers
✅ Validate tax IDs
✅ Apply reverse charge when applicable
Tax display:
Price display: Exclusive (show "€99 + VAT")
Invoice display: Show tax breakdown
Save

Note: Stripe Tax costs 0.5% of transaction volume. Alternative: Manual tax handling.

Part 8: Testing in Live Mode¶

8.1 Create Test Subscription¶

WARNING: This will create a REAL charge. Use a real card.

Create a test team in your app (as a real user would)
Navigate to billing settings
Click Upgrade to TEAM
Complete Stripe Checkout:
Use a real credit card (will be charged €99)
Complete 3D Secure authentication if prompted
Confirm payment
Verify in Stripe Dashboard:
Navigate to Payments
Confirm payment of €99 received
Status: "Succeeded"
Verify in your app:
Team plan updated to "team"
Subscription record created in database
Audit log entry created

8.2 Test Webhook Delivery¶

In Stripe Dashboard → Webhooks → Your endpoint
Check recent events:
checkout.session.completed - Delivered
Status: 200 OK
Response time: <2s
If webhook failed:
Click on failed event
Check error message
View request/response
Debug and retry

8.3 Test Customer Portal¶

In your app, navigate to team billing
Click Manage Billing
Verify redirected to Stripe Customer Portal
Test features:
✅ View invoices
✅ Download invoice PDF
✅ Update payment method
✅ Cancel subscription (don't actually cancel!)
Return to your app
Verify redirect back works

8.4 Test Cancellation Flow¶

Optional (will cancel your test subscription):

In Customer Portal → Cancel subscription
Select reason for cancellation
Confirm cancellation
Verify:
Subscription status: "Canceled (ends on [date])"
Database updated: cancelAtPeriodEnd: true
Team still has access until period end
Wait for period end (or manually expire in Stripe):
Navigate to Customers → Find customer → Subscription
Click Cancel subscription → Cancel now (admin action)
Verify:
Webhook customer.subscription.deleted delivered
Team plan downgraded to "free"
Access restricted to 20 analyses/month

Part 9: Production Deployment¶

9.1 Deploy to Vercel¶

Ensure all environment variables are set in Vercel

Push code to main branch:

git add .
git commit -m "Production Stripe configuration"
git push origin main

Vercel will auto-deploy (2-3 minutes)
Check deployment logs for errors

9.2 Verify Production Deployment¶

Navigate to https://codeslick.dev
Create a test team
Navigate to billing → Upgrade to TEAM
Verify Stripe Checkout opens correctly
DO NOT complete payment yet (unless you want to)

9.3 Monitor First Real Payment¶

When you get your first customer:

Watch Stripe Dashboard → Payments (real-time)
Check webhook delivery → Webhooks → Events

Verify database updated correctly:

SELECT * FROM teams WHERE plan = 'team';
SELECT * FROM subscriptions WHERE team_id = '...';

Check Vercel logs for any errors:

Vercel Dashboard → Logs → Filter by /api/billing

Part 10: Security Checklist¶

10.1 Production Security Validation¶

Before going live, verify:

✅ API Keys: Live secret key never committed to git
✅ Webhook Secret: Stored only in environment variables
✅ HTTPS: All URLs use https:// (no http://)
✅ Webhook Signature: Verification enabled in code
✅ Environment Separation: Test keys not in production
✅ Database Backups: Automated daily backups enabled
✅ Error Tracking: Vercel logs monitored
✅ Rate Limiting: Enabled on billing endpoints

10.2 Compliance Validation¶

For EU customers (GDPR, PSD2):

✅ Privacy Policy: Link in Stripe checkout
✅ Terms of Service: Link in Stripe checkout
✅ 3D Secure (SCA): Enabled for EU cards
✅ VAT Collection: Stripe Tax enabled
✅ Data Processing Agreement: Signed with Stripe

10.3 Monitoring Setup¶

Stripe Dashboard: 1. Enable email alerts: - Failed payments - Chargebacks/disputes - Webhook failures

Set up Slack notifications (optional):
Navigate to Settings > Notifications
Connect Slack workspace
Enable notifications for critical events

Vercel Monitoring: 1. Enable log drains (optional): - Send logs to external service (Datadog, LogDNA) - Alert on billing API errors

Set up Sentry (recommended):
Install: npm install @sentry/nextjs
Configure DSN
Monitor billing errors

Part 11: Troubleshooting¶

Common Issues¶

Issue 1: Webhook 400 Bad Request - Cause: Invalid signature - Fix: Verify STRIPE_WEBHOOK_SECRET matches Stripe Dashboard - Check: Vercel environment variable is set correctly

Issue 2: Checkout Session Expired - Cause: User took >24 hours to complete checkout - Fix: This is expected - user needs to create new checkout session - Prevention: None needed - Stripe automatically expires sessions

Issue 3: Payment Succeeded but Database Not Updated - Cause: Webhook failed to deliver or process - Fix: 1. Check webhook logs in Stripe Dashboard 2. Manually trigger webhook retry 3. If persistent, check Vercel logs for errors

Issue 4: 3D Secure Fails - Cause: Bank declined 3DS authentication - Fix: User must contact their bank - Alternative: Try different payment method

Issue 5: Subscription Not Canceled - Cause: customer.subscription.deleted webhook not received - Fix: 1. Check webhook logs 2. Manually cancel in Stripe Dashboard 3. Sync database:

UPDATE teams SET plan = 'free' WHERE stripe_customer_id = 'cus_...';
UPDATE subscriptions SET status = 'canceled' WHERE stripe_subscription_id = 'sub_...';

Debug Checklist¶

If something doesn't work:

✅ Check Stripe Dashboard → Webhooks → Events (shows all webhook attempts)
✅ Check Vercel Logs → Filter by /api/billing/webhook

✅ Check database:

SELECT * FROM audit_logs WHERE action LIKE '%subscription%' ORDER BY created_at DESC LIMIT 10;

✅ Test webhook manually in Stripe Dashboard
✅ Verify environment variables match Stripe Dashboard
✅ Check Stripe API version matches code (2025-09-30)

Part 12: Launch Checklist¶

Before announcing production billing:

Pre-Launch (Day 3)¶

Stripe live mode verified ✅
Products created (TEAM €99, ENTERPRISE €299) ✅
Webhook endpoint configured and tested ✅
Customer Portal configured ✅
Tax settings configured (EU VAT) ✅
Test subscription created and verified ✅
All environment variables set in Vercel ✅
Security checklist completed ✅

Launch Day (Day 4)¶

Monitor Stripe Dashboard for first payments
Check webhook delivery in real-time
Verify database updates correctly
Test customer portal with real subscription
Announce production billing to beta users

Post-Launch (Week 6+)¶

Monitor daily for failed payments
Review chargebacks/disputes weekly
Track MRR growth
Collect user feedback on billing experience
Optimize pricing based on data

Part 13: Pricing Strategy Notes¶

Current Pricing¶

FREE: €0/month, 20 analyses/month, 1 repo
TEAM: €99/month, unlimited analyses, 5 repos
ENTERPRISE: €299/month, unlimited everything

Future Optimizations (Month 2-3)¶

A/B Testing Ideas: 1. Test €79/month vs €99/month for TEAM 2. Test annual plans (€990/year = 2 months free) 3. Test usage-based pricing (€0.50 per analysis)

Volume Discounts: - 5-10 teams: 10% discount - 10-20 teams: 20% discount - 20+ teams: Custom enterprise pricing

Lifetime Deals (not recommended): - Avoid lifetime deals (unsustainable) - Use 1-year prepaid instead (€990 for TEAM)

Conclusion¶

Production Stripe Setup: ✅ COMPLETE

You are now ready to accept live payments from customers!

Next Steps: - Day 4: Beta user testing (5-10 teams) - Week 6: Public launch + marketing

Support: - Stripe Support: https://support.stripe.com - Stripe Dashboard: https://dashboard.stripe.com - CodeSlick Docs: See PHASE_4_WEEK_5_DAY_1_2_COMPLETE.md for security validation

Emergency Contacts: - If payment issue: Check Stripe Dashboard first - If webhook issue: Check Vercel logs - If database issue: Check audit_logs table

Document Version: 1.0 Last Updated: October 24, 2025 Ready for Production: ✅ YES