Generated banner for Stripe Apps
Generated logo for Stripe Apps

Stripe Apps

StripeOfficialPublished by Stripe

  • Skill
  • Tool integration
  • Software development
  • MIT
  • No issues found

From the author

Build, modify, or review Stripe Apps and extensions using the relevant documentation and reference guides. Use for custom Stripe Dashboard UI, stripe-app.yaml, @stripe/ui-extension-sdk, @stripe/extensibility-sdk, script extensions, extension interfaces, custom workflow actions, and apps that authenticate to Stripe or react to events. Also use when deciding whether a Stripe extension can support the user's billing or workflow requirements.
— the description by Stripe

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a structured approach to developing and maintaining Stripe Apps. It guides users through selecting the correct extension architecture, implementing authentication, building UI components, and managing backend services or webhooks. By leveraging bundled reference files and canonical documentation, it ensures that app development follows Stripe's best practices for security, configuration, and lifecycle management.

What it does

  • Provides guidance on selecting the appropriate Stripe extension interface.
  • Assists in building and modifying Stripe Dashboard UI components.
  • Supports the implementation of backend services, webhooks, and secret storage.
  • Helps determine the correct authentication method for Stripe API access.
  • Offers instructions for testing, debugging, and publishing Stripe Apps.
  • Clarifies the applicability of extensions for specific billing or workflow requirements.

When to use it

  • When you need to build a custom UI extension for the Stripe Dashboard.
  • When deciding between Restricted API keys, Platform keys, or OAuth for your app.
  • When implementing backend logic or handling Stripe events via webhooks.
  • When you need to store sensitive credentials securely using the Secret Store API.
  • When troubleshooting or modifying an existing Stripe App's manifest or configuration.

Advantages

  • Ensures alignment with official Stripe development patterns and security standards.
  • Reduces development time by providing clear paths to relevant documentation.
  • Helps prevent common architectural errors in app authentication and event handling.
  • Provides a consistent workflow for the entire app lifecycle from scaffolding to release.

Usage examples

“How do I determine if my Stripe App needs a backend?”
The agent will reference the backend documentation to explain that a backend is required for long-term data storage, server-side secrets, or handling webhooks, while suggesting the Secret Store API for simpler needs.
“Help me choose the right authentication type for a private Stripe App.”
The agent will compare Restricted API keys, Platform keys, and OAuth, recommending Restricted API keys as the simplest and most secure choice for private integrations.

Install

  1. Download the skill as a ZIP:

    https://mp-staging.autogineer.com/agent-skills/stripe/stripe-apps/download
  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip stripe-apps.zip -d .agents/skills

Documentation by Stripe

Stripe Apps

Select and read the existing guidance for the user’s task. Product documentation describes what an extension can do; implementation guides describe how to build it. Before recommending an extension or writing code, load the applicable bundled reference files as well as the relevant product documentation. A link or filename in this skill isn’t a substitute for reading its contents.

For a capability question, check native Stripe features and the documented applicability and limitations of the extension. For an implementation request, create or modify working files using the selected guide. For an existing app, inspect its manifest, packages, installed SDK, and local agent instructions before deciding what to change.

Choose the relevant documentation

Use information already supplied by the user or existing app. Read <references/discovery.md> when you need to clarify the app’s requirements, and <references/extension-types.md> for an overview of app architectures. Ask only for missing information that affects the task.

Product capabilities

Use these existing product documents to determine which capability fits and whether the account has the required access. Don’t infer support from an extension’s name or the existence of a scaffold.

TaskRead
Select an extension interface and its supported implementation typesExtension points and how extensions work
Change how items are included on subscription invoicesItem handling extensions
Customize prorationsNative proration behavior and prorations extensions
Apply customer balancesCustomer balance extensions
Calculate discount amountsDiscount calculation extensions
Add an action to Stripe WorkflowsExisting workflow actions, existing custom actions, and how custom actions work
Customize another product’s behaviorFollow the selected interface’s product documentation from the extension-point catalog
Implementation guidance

The references/*.md files are bundled with this skill. After selecting the capability, load the applicable files before following their links to supporting documentation. Combine rows when an app needs multiple types. Follow the selected guide’s prerequisites, scaffolding, testing, and debugging instructions.

TaskRead
Build or modify any Dashboard UI, including drawers and full-page apps<references/ui-extensions.md>, then each selected component’s current API documentation
Author, test, or debug a script extension<references/script-extensions.md>, then the selected extension point’s implementation guide
Build a custom-action script<references/script-extensions.md> and build a custom action with a script
Build a custom-action remote functionBuild a custom action with a remote function
Build a self-hosted UI back-end or webhook service<references/backend.md> and <references/authentication.md>; also load <references/webhooks.md> when receiving Stripe events
Store app credentials with the Secret Store APIThe Secret Store API section in <references/backend.md> and store secrets, including for apps without a self-hosted back-end
Look up APIs, SDK patterns, configuration, or additional extension documentation<references/canonical-docs.md>

Use the UI reference for layout and composition, and current component documentation for import paths, props, and styling APIs. For scripts and remote functions, follow the selected extension’s documentation; UI and self-hosted back-end instructions don’t define their runtime capabilities.

Shared app lifecycle

Read these references when the corresponding task is needed. Reuse existing apps and packages; scaffold only what is missing.

TaskRead
Scaffold, build, test, preview, or upload an app<references/workflow.md>, together with the selected implementation guide
Choose authentication for access to Stripe APIs<references/authentication.md>
Receive Stripe events<references/webhooks.md>
Build a first-run setup experience<references/onboarding-ux.md> and the UI reference
Release versions, change installed permissions, or publish to the marketplace<references/publishing.md>
Submit feedback after running app toolchain commands<references/feedback.md>

Load bundled reference files

  1. Use the task tables to select every applicable bundled reference under references/, then open those files with a file-reading tool before starting the corresponding work. For example, UI with a self-hosted back-end needs both UI and back-end guidance; onboarding also needs the UI reference.

  2. Follow relevant pointers to other bundled references inside the files you load, including filenames written as code rather than links. For example, back-end guidance can require authentication guidance, and changing permissions can require publishing guidance. Use this skill’s direct links to locate those files.

  3. Read the canonical documentation required by those references. External documentation supplements the bundled guidance on workflow, layout, and other task-specific decisions.

  • Resolve references/ paths relative to this skill’s directory and bare reference filenames relative to its references/ directory. When reading the hosted skill, fetch the corresponding reference URLs relative to the skill URL.

  • Load only references relevant to the task, and reuse contents already read during the session unless they have changed. A full-stack app doesn’t require every document in the skill.

  • Read canonical pages using the available documentation tools. Prefer stripe docs when available, including for pages that require account access.

  • Use current product documentation and the installed SDK’s types for API contracts and limitations. If an example in a reference disagrees, check the version and follow the applicable canonical documentation.

  • Read any interface-specific agent instructions supplied with an existing or newly generated extension. If none are present, use the linked product and implementation guides.

  • If the documentation doesn’t establish that an extension meets a requirement, state what is unknown or unsupported before proceeding.

  • Keep the work within the user’s request. Report the changes, validation results, and remaining steps relevant to that app.

Files

references/backend.md

Backend — when and how to add server-side logic

When you need a backend

You need a backend if your app needs to:

  • Store data long-term (user preferences, linked accounts, custom records)

  • Call APIs that require server-side secrets (API keys that can’t be in the browser)

  • Run logic when the user isn’t in the Dashboard (webhooks, scheduled jobs)

  • Call third-party services securely (email providers, CRMs, spreadsheet APIs)

  • Perform actions that take longer than the UI can wait for

You don’t need a backend if:

  • Your app only reads and displays Stripe data (use the SDK client directly in the UI)

  • You only need to store a small amount of sensitive data — use the Secret Store API instead

Canonical documentation

Before writing back-end code, read these pages using an available documentation tool:

TopicURL
Backend implementation + fetchStripeSignaturehttps://docs.stripe.com/stripe-apps/build-backend
Authentication types (determines backend pattern)https://docs.stripe.com/stripe-apps/api-authentication
Events and webhookshttps://docs.stripe.com/stripe-apps/events
Secret Store APIhttps://docs.stripe.com/stripe-apps/store-secrets

Backend architecture decisions

Authentication type determines the backend pattern

Your app’s stripe_api_access_type controls how the backend authenticates. See authentication.md for the full breakdown of auth types and when to use each one.

CORS configuration

CORS (Access-Control-Allow-Origin: *) is needed ONLY on endpoints called by the UI extension. The UI runs in a sandboxed iframe with a null origin — specific origin allowlisting won’t work.

Webhook endpoints do NOT need CORS — they receive requests from Stripe’s servers, not from the browser.

fetchStripeSignature verification

fetchStripeSignature is how the UI extension authenticates requests to your backend. The signed payload and verification method are documented at https://docs.stripe.com/stripe-apps/build-backend.

Key facts:

  • The signing secret (starts with absec_...) is generated on first stripe apps upload

  • The default signed payload contains user_id and account_id (field order matters)

  • Extra data can be included by passing it to fetchStripeSignature(payload)

  • Verification uses stripe.webhooks.signature.verifyHeader()

Webhook configuration

Webhook setup depends on your app’s distribution and auth type:

App typeWebhook setup
Private (your account only)ONE standard webhook endpoint
Public with platform keysONE webhook with “Listen to events on Connected accounts” enabled
Public with restricted API keysCan’t use Connect webhook fanout — each merchant manages their own webhooks

The event_read permission MUST be declared in your manifest, plus read permissions for each event type you want to receive.

Read https://docs.stripe.com/stripe-apps/events for the full setup guide.

For firewall allowlisting of inbound webhook traffic, see https://docs.stripe.com/ips for Stripe’s IP addresses.

Secret Store API

Plain-language: “Stripe has a built-in secure place to store passwords, tokens, and API keys for your app — you don’t need to build your own database for secrets.”

Two scopes
ScopeUse forExample
accountShared across all users of an accountThe business’s API key for an email service
userPer-user secretsAn individual user’s OAuth access token
Limits and restrictions
  • Maximum 10 secrets per scope (account and user separately)

  • Always list and delete before adding more if approaching the limit

  • Do not store PCI-sensitive data (card numbers, CVVs, bank account numbers)

Declaring the permission

In stripe-app.yaml:

declarations:
  stripe_api_access:
    permissions:
      - permission: secret_write
        purpose: Store third-party credentials for the app
Implementation

For the correct code patterns to read, write, and delete secrets, read: https://docs.stripe.com/stripe-apps/store-secrets

Local development with a backend

Run your backend locally alongside stripe apps start:

# Terminal 1: start the app preview
stripe apps start

# Terminal 2: start your backend server
node server.js

For webhook forwarding during local development, see references/webhooks.md.

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
Stripe
Publisher
Stripe (Official)
Source
stripe/ai · skills/stripe-apps · commit 38fa045
Licence
MIT License (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced
Also distributed in
stripe/ai, stripe/ai, stripe/ai, stripe/ai, stripe/ai

AutoGineer is not affiliated with or endorsed by Stripe.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download stripe-apps.zip