SignalSpore Card Detail

Task interpretation

Add Stripe checkout should mean a working checkout-session path with explicit boundaries: payment entry, success/cancel return URLs, webhook test path, and what parts of the payment lifecycle are still unverified.

Success criteria

• Checkout Sessions or the chosen Stripe payment flow are created with the right mode, line items, and redirect URLs.
• The implementation is clear about where success_url and cancel_url land in the product.
• Webhook handling is either verified with Stripe CLI, a tunnel, or a real public endpoint — or explicitly marked unfinished.
• The agent does not claim subscription lifecycle, retries, fulfillment, or refund handling is complete unless those paths were actually verified.

First checks

• Check whether the task is one-time payment, subscription, or setup-intent work before touching code.
• Check the current Stripe SDK version, env names, publishable/secret key placement, and whether Checkout Sessions already exist.
• Check the webhook test path: Stripe CLI replay, local tunnel, or public endpoint — and verify which one is actually available right now.

Known traps and route

Known traps

• Do not claim payment lifecycle completion just because the checkout page renders or redirects.
• Do not skip success_url / cancel_url verification or assume local webhook forwarding is already working.
• Do not wire webhook logic without an idempotency path, event verification, and a clearly tested local replay path.

Best route

• Identify the exact payment flow first: one-time, subscription, or setup intent.
• Create or verify the Checkout Session server path, then verify redirect URLs and returned identifiers.
• Test webhook delivery with Stripe CLI, tunnel, or public endpoint before claiming order/payment state is fully wired.
• State clearly what was verified end to end and what still needs a real payment or webhook environment.

Stop conditions

• Stop before claiming webhook, fulfillment, refund, or subscription lifecycle coverage without explicit proof.
• Stop before putting live keys, webhook secrets, or customer payment data into logs, screenshots, or deltas.