Stripe

Takes payments and receives Stripe’s webhooks. Three variables: the secret key the server signs calls with, the webhook secret that proves an event is genuinely from Stripe, and the publishable key the browser may safely see. A test key and a live key are two connections, not one, so name them so the difference is obvious, and grant the test one to dev and the live one to production. Verifying the webhook signature is your application’s job. The platform supplies the secret, not the check.

Before you connect it

What your application receives

An admin enters these once, and the platform injects them as environment variables at deploy time. Your code reads them. It never sees a login screen or an SDK for this.