stripe-best-practices Skill for Claude: Build Stripe Integrations the Recommended Way

stripe-best-practices steers your coding assistant to Stripe's recommended APIs and safe key handling when you plan, build or review an integration.

Installs: 100.6K; on skills.sh
Stars: 2K; on GitHub
Files: 6; besides SKILL.md
Updated: Nov 2026; last repo commit

stripe-best-practices is Stripe's own guide for assistants. It routes each job to the right API (for example Checkout Sessions for one-time payments, Accounts v2 for Connect, Billing APIs for subscriptions, Stripe Tax with registrations) and points to a reference file for each area. It defaults to separate sandboxes for development and to restricted API keys (rk_) over secret keys (sk_).

It also sets hard rules: never pass payment_method_types except for Terminal, never treat webhooks as optional, always use a StripeClient instead of the global API key, and confirm a tax registration before turning on automatic tax. It loads when you plan, build, test or review any Stripe integration. It bundles no scripts.

Good for

Developers adding payments or subscriptions with Stripe
Teams building marketplaces on Stripe Connect
Reviewers checking key handling, webhooks and tax setup

Install stripe-best-practices

Claude Code

Copy this prompt.

Install the stripe-best-practices skill in Claude Code. Run this command:

claude plugin install stripe@claude-plugins-official

Then check that it loaded and tell me how to use it.

2
Paste it into Claude Code. It shows the change and asks before running it.

The README recommends the plugin because it includes additional agent tools and updates itself. It says manually installed skills do not auto-update; run npx skills update -y to refresh them. Pick one route.

From the project README. Source.

What's in the skill

When it loads

Guides Stripe integration decisions across development and test environment planning (separate sandboxes vs the shared test mode sandbox), API selection (Checkout Sessions vs PaymentIntents), Connect platform setup (Accounts v2, controller properties), billing/subscriptions, tax and registrations (Stripe Tax, automatic_tax, product tax codes), Treasury financial accounts, integration options (Checkout, Payment Element), migrating from deprecated Stripe APIs, and security best practices (API key management, API key permissions, webhooks, OAuth). Use when planning, building, modifying, testing, or reviewing any Stripe integration, including choosing a development environment, accepting payments, building marketplaces, integrating Stripe, processing payments, setting up subscriptions, collecting sales tax, VAT, or GST, creating connected accounts, or implementing secure key handling.

Sections in SKILL.md

Integration routing
Critical rules
Key documentation

Key facts

Author: Stripe
Repository: stripe/ai, folder skills/stripe-best-practices
Installs on skills.sh: 100,626 (as of 2026-11-02)
Repo stars: 2,026 (whole repository, as of 2026-11-02)
License: MIT
Last repo commit: 2026-11-01
Files in the skill folder: 7 files: SKILL.md and 6 reference guides
skills.sh audits: Gen Agent Trust Hub: pass, Socket: pass, Snyk: pass

What it includes

Pick the API for what you are building
Table from one-time payments to Connect, subscriptions, Tax and financial accounts, each with a reference file.
Read · Integration routing
Separate sandboxes for development and CI
Suggests `stripe sandbox create` when you have no account, and says not to use MCP after it unless `stripe sandbox claim` is run.
Runs code · Sandbox default
Restricted keys over secret keys
Always recommends a restricted API key with the rk_ prefix.
API key default
Do not use payment_method_types; webhooks are not optional
Also: instantiate StripeClient, check tax registration before automatic tax, and tag Checkout Sessions with integration_identifier.
Write · Critical rules
Payments, Connect, billing, tax, treasury, security
Opened before the assistant answers an integration question or writes code.
Read · Reference guides
Key storage, RAK migration, webhooks, OAuth, 2FA
The security.md guide says never to put keys in source code, to store them in the platform's secrets vault, to flag strings matching live key patterns, and to help set up a pre-commit hook that catches sk_ and rk_ keys.
Write · Security reference
Integration options, API tour, go-live checklist
Links for requests that do not fit one area.
Network · Key documentation

From the official docs

Permissions

Medium risk

It guides code that handles payments and API keys. Build against sandbox keys, use restricted keys, and review webhooks and tax settings before you go live.

What it can do

Read your data
Create and change things
Delete things
Read-only mode

Watch out for

Payment code needs careful review
The assistant will write code that creates charges, subscriptions and tax settings. Test in a sandbox and review webhook and fulfillment logic before going live.
Keep live keys out of the assistant
The skill recommends restricted keys and covers key management. Use sandbox keys while building, and never paste a live secret key into chat.
It may run the Stripe CLI
It suggests installing the Stripe CLI with npm and running `stripe sandbox create` to make test keys. Confirm those commands first.
The plugin route adds more than the skill
The README recommends the official Stripe plugin because it includes additional agent tools and updates automatically. A skills-only install does not update automatically. Check what the plugin adds before you enable it on a project with live keys.

Technical details

Talks to	Stripe API, when your code or the Stripe CLI runs
Scopes	Stripe API keys (restricted keys recommended)

Questions

What does the stripe-best-practices skill do?

It guides your assistant to use Stripe's current recommended APIs and patterns. It covers payments, Connect, subscriptions, tax, financial accounts and security such as key management and webhooks.

How do I install stripe-best-practices?

Use the install box at the top of the page. The Stripe README recommends the official Stripe plugin for Claude Code because it adds agent tools and updates itself. A skills-only install does not update automatically.

Does it need a Stripe API key?

The SKILL.md asks for none. It tells the assistant to use sandboxes, and the Stripe CLI can create a sandbox with test keys without registration. For live use it recommends restricted keys.

Can it move real money?

The skill is instructions for writing and reviewing code and bundles no scripts. Code you ship moves money when it runs with live keys, so build against a sandbox first and keep live keys out of chat.

Is stripe-best-practices safe?

It bundles no scripts and its rules push safer defaults such as restricted keys and sandboxes. The risk is in the payment code the assistant writes, so review it, and keep live keys out of chat and out of source code.

Is this the same as the Stripe MCP server?

No. This skill is guidance for building integrations. The Stripe README separately describes MCP for agent tools, and says not to use MCP after stripe sandbox create until the sandbox is claimed.

Information

updated Nov 2, 2026

Repository: stripe/ai
Folder: skills/stripe-best-practices

stripe/ai skills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 4

stripe/ai README · github.com
skills.sh listing · skills.sh
stripe-best-practices SKILL.md · github.com
stripe-best-practices security.md · github.com