Stripe Setup: Create Account, API Keys, SDK Installation & Configuration

In this tutorial, you will learn about Stripe Setup: Create Account, API Keys, SDK Installation & Configuration. We cover key concepts, practical examples, and best practices to help you master this topic.

Setting up Stripe correctly means creating a Stripe account, obtaining API keys (publishable and secret), installing the SDK, configuring Webhook endpoints, and organizing keys per environment.

What You'll Learn

How to set up Stripe from scratch: create an account, find API keys, install the Stripe SDK, configure test vs live mode, set up webhook signing, and manage environment-specific configs.

Why It Matters

Incorrect setup causes payment failures, security risks, and debugging nightmares. DodaTech uses separate Stripe accounts for development, staging, and production with strict key management.

Real-World Use

A developer clones the repo, creates a Stripe test account, copies test keys to .env, installs stripe pip package, and starts building the payment flow immediately.

flowchart LR
    A["Create Stripe\nAccount"] --> B["Get API Keys\nTest Mode"]
    B --> C["Set Environment\nVariables"]
    C --> D["Install SDK\npip install stripe"]
    D --> E["Make First\nAPI Call"]
    A --> F["Configure\nWebhooks"]
    F --> G["Get Webhook\nSigning Secret"]
    style A fill:#6772e5,color:#fff
    style C fill:#dbeafe,stroke:#2563eb
    style E fill:#bbf7d0,stroke:#16a34a

Account Setup

# 1. Sign up at dashboard.stripe.com/register
# 2. Verify email and provide business details
# 3. Enable test mode (toggle in dashboard)
# 4. Copy API keys from Developers > API Keys

# Test keys (prefix: sk_test_ / pk_test_)
# Live keys (prefix: sk_live_ / pk_live_)

# NEVER commit API keys to version control!

SDK Installation

# Python
pip install stripe

# Node.js
npm install stripe

# Or for the Stripe CLI (webhook testing):
# macOS: brew install stripe/stripe-cli/stripe
# Linux: curl -s https://packages.stripe.dev/api/security/key | gpg --dearmor | sudo tee /usr/share/keyrings/stripe.gpg

Environment Configuration

import stripe
import os

# Load from environment variables
stripe.api_key = os.environ.get("STRIPE_SECRET_KEY")
STRIPE_PUBLISHABLE_KEY = os.environ.get("STRIPE_PUBLISHABLE_KEY")
STRIPE_WEBHOOK_SECRET = os.environ.get("STRIPE_WEBHOOK_SECRET")

print(f"Stripe configured: {'TEST' if stripe.api_key.startswith('sk_test_') else 'LIVE'}")
print(f"API key prefix: {stripe.api_key[:7]}...")

# In .env file:
# STRIPE_SECRET_KEY=sk_test_...
# STRIPE_PUBLISHABLE_KEY=pk_test_...
# STRIPE_WEBHOOK_SECRET=whsec_...

Webhook Setup

# In Stripe Dashboard:
# Developers > Webhooks > Add endpoint
# Endpoint URL: https://api.dodatech.com/stripe/webhook
# Events to send: checkout.session.completed, payment_intent.succeeded,
#                 customer.subscription.updated, invoice.payment_failed

# Install Stripe CLI for local testing:
# stripe listen --forward-to localhost:5000/stripe/webhook

# The CLI provides a signing secret for local development:
# whsec_abc123...

Common Mistakes

1. Committing API Keys to Git

API keys in source code are a security vulnerability. Use environment variables and add .env to .gitignore.

2. Using Live Keys in Development

Live keys Process real money. Accidentally charging yourself $20.00 during testing is expensive. Always use test keys in development.

3. Forgetting Webhook Signing Secret

Without the webhook secret, you can't verify webhook signatures. Anyone can send fake events to your endpoint. Always validate signatures.

4. Not Rotating API Keys

Rotate API keys periodically and immediately after a suspected breach. Regenerate test and live keys separately.

5. Hardcoding Stripe Config per Environment

Configs for dev, staging, and prod should be in environment variables or a config service, not code. Use separate Stripe accounts per environment.

Practice Questions

1. What is the difference between pk_test_ and sk_test_ keys?
2. How do you verify a webhook request is from Stripe?
3. How do you switch between test and live mode?
4. How do you test Webhooks locally?

Answers:

1. pk_ (publishable key) is safe to share with client-side code. sk_ (secret key) is server-only and must be kept confidential.
2. Use stripe.Webhook.construct_event(payload, sig_header, webhook_secret). This verifies the HMAC signature using your webhook signing secret.
3. Switch by changing the API key in your config. Test keys start with sk_test_, live keys with sk_live_.
4. Use the Stripe CLI: stripe listen --forward-to localhost:5000/stripe/webhook. It forwards real-looking events to your local server.

Challenge: Set up a complete Stripe development environment: create account, obtain test keys, install the SDK, configure environment variables, set up a local webhook listener with Stripe CLI, and verify the connection with a test API call.

FAQ

Mini Project

Set up a full Stripe development environment: create a Stripe account (test mode), obtain API keys, install Stripe SDK, configure .env, create a test endpoint that creates a PaymentIntent, and verify with Stripe CLI.

What's Next

Charges API — understand the legacy charge API (deprecated).