Stripe
One secret key powers web checkout end to end: price listing, session creation, and the webhook that turns payments into entitlements.
Dashboard → Setup → Connections → Stripe. Paste your secret key (sk_live_…, or sk_test_… while testing). It's verified with a read of your account details before it's stored, encrypted at rest, and never returned by any endpoint.
What the key is used for
- Listing your recurring prices — the Web Checkout card's plan dropdown is your live Stripe catalog.
- Creating Checkout Sessions on your account — the buyer's identity is written into the session and the subscription metadata, so renewals stay attributable from month two onward.
- Reading subscriptions back — a completed checkout is followed by a subscription read to learn the real expiry; an entitlement with no expiry fails closed rather than guessing.
- Registering the webhook endpoint — saving the Web Checkout card in hosted mode creates Fictura's webhook on your Stripe account automatically; the signing secret (
whsec_…) is stored with the connection.
The webhook, precisely
Fictura consumes exactly three Stripe event types — checkout.session.completed, customer.subscription.updated, and customer.subscription.deleted — and derives the whole billing story from them: purchases, trial conversions, renewals, cancellations (cancel_at_period_end), billing issues (past_due), and expirations. Signatures are verified the way Stripe specifies — HMAC-SHA256 over timestamp.body with a ±5-minute tolerance — and test-mode events are tagged SANDBOX so they never grant production access.
Your account, your money
Everything happens on your Stripe account with your key: your prices, your customers, your payouts, your refund button. Fictura routes the buyer and records the outcome — it is never in the money path. See How web checkout works.