senternet-site-stripe

Create a Firebase Cloud Function that builds a Stripe Checkout Session and redirect the browser to its URL, or use the embedded Payment Element with a callable function returning a clientSecret. Store the Stripe secret key in Firebase Secret Manager and handle checkout.session.completed in a webhook function.

Hosted Checkout redirects the browser to Stripe's page and needs no frontend Stripe SDK, making it the default for fixed products or licenses. The embedded Payment Element keeps the payment UI on your domain and suits dynamic amounts like donations, but requires @stripe/stripe-js and @stripe/react-stripe-js.

Use stripe.webhooks.constructEvent with the request's raw body, the stripe-signature header, and the webhook signing secret stored as STRIPE_WEBHOOK_SECRET. Register the deployed function URL as a webhook endpoint in the Stripe Dashboard subscribed to checkout.session.completed.

The Functions emulator loads defineSecret values only from functions/.secret.local, not from functions/.env. A .env file provides non-secret runtime config, so secrets like STRIPE_SECRET_KEY come back empty unless placed in .secret.local.

The recoverPurchase endpoint looks up the customer's email in Stripe, emails a 6-digit OTP via Resend, and reissues the JWT token or signed download URL after verification. It uses a 15-minute TTL, a 5-attempt cap, and constant-time responses to avoid revealing whether an email is a customer.

Yes. Map each plan to its Stripe price ID and set the Checkout Session mode to subscription for recurring prices or payment for one-time prices. A single checkout function can mix both, as the premail reference does with monthly, annual, and lifetime plans.