No trusted browser price
Financial terms come from the registered server catalog.
Security model
Stripe payment security starts with a narrow trust boundary.
Vidle Pay keeps financial authority on the server, sends payment details directly to Stripe, and verifies every asynchronous state transition.
Reduced payment-data exposure
Payment details go directly to Stripe.
Stripe Embedded Checkout renders the provider-owned interface. Vidle Pay receives Stripe object identifiers and business status, not full card numbers or CVC values.
The browser submits no trusted amount, currency, Price ID, merchant route, customer identity, or arbitrary return URL. An authenticated product server chooses a registered SKU; the database freezes its EUR amount and billing contract on the order.
Production secrets live in Cloudflare Worker secrets. App credentials are stored only as keyed digests, and short-lived checkout recovery tokens are purpose-separated.
No client-side fulfillment
A success screen never grants access.
Least-privilege database
The Worker uses a restricted role without migration-ledger access.
Application isolation
Every request is scoped to one approved App.
Each app credential resolves to one active application record. Orders, customers, prices, subscriptions, refunds, and return URLs are queried under that App ID and its exact verified origin.
Unique external order IDs and semantic request fingerprints make retries safe without allowing a reused ID to change users, SKUs, quantity, or attribution. Database keys prevent product origins and app-scoped records from crossing tenants.
Event integrity
Verify every asynchronous boundary.
Stripe signatures are verified against the untouched raw body and the shared pool endpoint secret. Provider event IDs are unique, Queue claims use processing leases, and retries cannot apply the same entitlement twice.
Every Stripe order is bound to Mindepy and one App. Retrieval, reconciliation, refunds, disputes, Billing Portal, and callbacks fail closed when the object attribution does not match.
Product callbacks use a separately derived per-App secret, version header, timestamp, raw body, and stable event ID.
Responsible operations
Security continues after deployment.
Dependencies, Worker configuration, endpoint behavior, Queue health, Stripe delivery failures, and database privileges require ongoing review.
Report a potential issue privately to support@vidle.org. Include the affected URL and a safe reproduction, but never send real payment data, customer secrets, or API keys.
Questions, answered
Frequently asked questions
Does Vidle Pay store card numbers?
No. Stripe collects payment details in its provider-owned interface. Vidle Pay stores only the order and Stripe identifiers needed to reconcile the purchase.
Can the browser mark an order paid?
No. Fulfillment depends on verified Stripe events and durable server processing, not a redirect, modal callback, or browser message.
Build on a reliable payment boundary
Give every SaaS product one secure way to charge.
Start with the integration guide, then register the app, domain, and server credentials before enabling checkout.