Stripe Testing Best Practices: From Test Cards to Production Confidence

Codeberg and Forgejo Actions: A Complete Guide for Self-Hosted CI/CD

Practical guide to using Codeberg, the tea CLI, and Forgejo Actions for self-hosted CI/CD pipelines — including secrets management, action migrations, and common pitfalls.

Introduction

Stripe makes payments easy to integrate. Testing those payments reliably is another matter entirely. A single missed edge case — an unpaid session recorded as a purchase, a webhook replayed twice, or a download URL controlled by the client — can cost you real money and real customer trust.

This guide covers the complete Stripe testing paradigm, distilled from building and hardening a production checkout system with digital downloads, physical orders, and subscription billing.

The Stripe Testing Landscape

Test Mode vs Live Mode

Stripe operates in two modes, toggled in the Dashboard:

Key insight: Your server code doesn't change between modes. The only difference is which API keys you use. This means your test infrastructure should mirror production exactly — same webhook handlers, same idempotency logic, same validation.

When Test Cards Work

Test card numbers (like 4242424242424242) work in two scenarios:

1. Test mode keys (sk_test_*) — always work, whether through API or Checkout
2. Live mode keys (sk_live_*) — accepted by the API (session creation succeeds), but rejected by Stripe Checkout's hosted payment page at the point of payment

This means you can create checkout sessions programmatically with live keys and test cards, but the customer-facing payment step will fail. For end-to-end testing, always use test keys.

Essential Test Card Numbers

Not all test cards are equal. Stripe provides a rich set of cards to simulate specific scenarios:

Basic Success and Failure

3D Secure (3DS) Authentication

Pro tip: Test 3DS cards with payment_method_options[card][request_three_d_secure] = 'any' to ensure your flow handles authentication challenges.

Edge Cases That Matter

Testing the Checkout Flow

Architecture Overview

A typical Stripe checkout integration has four stages:

Critical Guard: payment_status and mode

One of the most common bugs: the checkout.session.completed webhook fires for all checkout sessions — including unpaid ones. SEPA payments arrive with payment_status: "unpaid" initially. Subscription checkouts fire this event too.

// ❌ WRONG — records purchases for unpaid sessions
case "checkout.session.completed": {
  const session = event.data.object;
  // Missing: no check on payment_status or mode!
  pushPurchase({ session_id: session.id, ... });
}

// ✅ CORRECT — only record completed payments
case "checkout.session.completed": {
  const session = event.data.object;
  if (session.mode !== "payment" || session.payment_status !== "paid") {
    logger.info(`Skipping non-payment: ${session.id}`);
    break;
  }
  pushPurchase({ session_id: session.id, ... });
}

Critical Guard: Never Trust Client-Supplied Download URLs

A sophisticated attack: an attacker buys the cheapest product but overrides downloadUrl in the checkout request to point at an expensive product's file. The flow:

The fix: resolve download paths server-side from content frontmatter, ignoring client metadata entirely.

// Server-side resolver — single source of truth
export async function resolveProductDownloadUrl(slug: string) {
  const content = await getContent("products", slug);
  return content?.frontmatter?.download_url || null;
}

// In webhook: resolve from content, not from client metadata
const downloadUrl = await resolveProductDownloadUrl(item.slug);
const token = signDownloadToken({ product_slug: slug, download_url: downloadUrl });

Critical Guard: Idempotency-Keys for API Calls

Webhook idempotency covers Stripe → you. The reverse direction needs equal care: your server → Stripe. Without an idempotency key, a client network retry (POST /api/stripe/create-checkout) creates two checkout sessions — and two potential purchases.

// Create checkout with an idempotency key derived from cart + user
const session = await stripe.checkout.sessions.create(
  { mode: "payment", ... },
  { idempotencyKey: `${userId}:${cartFingerprint}` }
);

The same key must return the same session (Stripe dedupes); a different key creates a new one. Your tests must cover: same key twice → one session; different key → separate sessions; a retried request after a network error → no duplicate purchase.

Webhook Testing Strategies

Strategy 1: Unit Tests with Mocks (Fastest)

Mock Stripe's webhook construction and test your handler logic in isolation:

// tests/unit/api/stripe/webhook.test.ts
vi.mock("@/lib/stripe", () => ({
  constructWebhookEvent: mockConstructEvent,
}));

it("records purchase for paid checkout", async () => {
  mockConstructEvent.mockReturnValue({
    type: "checkout.session.completed",
    data: {
      object: {
        mode: "payment",
        payment_status: "paid",
        id: "cs_test_123",
        metadata: { productName: "Test", productSlug: "test" },
        customer_details: { email: "buyer@test.com" },
      },
    },
  });

  const res = await POST(mockRequest("{}", "sig_abc"));
  expect(res._status).toBe(200);
  expect(mockPurchases).toHaveLength(1);
  expect(mockSendMail).toHaveBeenCalled();
});

Coverage targets for webhook tests:

Strategy 2: Stripe CLI Forwarding (Integration Test)

Install the Stripe CLI and forward real webhook events to your local server:

# Install (macOS)
brew install stripe/stripe-cli/stripe

# Login (gets your test-mode API key)
stripe login

# Forward webhooks to localhost:3000
stripe listen --forward-to localhost:3000/api/stripe/webhook

# This prints your webhook signing secret (whsec_...)
# Add it to your .env.local:
# STRIPE_WEBHOOK_SECRET=whsec_xxx

Then trigger a test event:

# Trigger a checkout completion event
stripe trigger checkout.session.completed

# Trigger a payment failure
stripe trigger payment_intent.payment_failed

# Trigger a subscription event
stripe trigger customer.subscription.updated

Strategy 3: Back-to-Back Flow Tests

Test the entire flow: checkout → webhook → download, including state management across calls:

it("checkout → webhook → download flow succeeds", async () => {
  // 1. Create checkout
  const checkout = await createCheckout({ priceId: "price_test", ... });
  expect(checkout._data.checkoutURL).toBeDefined();

  // 2. Fire webhook (simulates Stripe calling your server)
  mockConstructEvent.mockReturnValue({
    type: "checkout.session.completed",
    data: { object: { mode: "payment", payment_status: "paid", ... } },
  });
  const webhook = await webhookHandler(mockRequest({}, "sig"));
  expect(webhook._status).toBe(200);

  // 3. Download with signed token
  const token = signDownloadToken({ session_id: "cs_123", ... });
  mockRetrieve.mockResolvedValue({ payment_status: "paid" });
  const download = await downloadHandler(mockDownloadRequest(token));
  expect(download._status).toBe(200);
});

Strategy 4: Retry Semantics — Acknowledge Fast, Process Async

Stripe retries webhook deliveries when your endpoint does not return a fast 2xx, using exponential backoff that can span days. A handler doing slow work synchronously (sending emails, generating invoices, building downloads) risks timing out: Stripe retries, and now the same event is in flight twice. Two rules:

1. Return 2xx fast after signature verification and validation — enqueue the actual work
2. Keep idempotency downstream — retries redeliver the same event, and the async worker must dedupe exactly like the sync handler does

// ✅ Webhook: validate, acknowledge, enqueue
export async function POST(request: Request) {
  const event = verifyAndParseBody(await request.text(), request.headers.get("stripe-signature")!);
  await purchaseQueue.enqueue({ session_id: event.data.object.id }); // durable queue
  return Response.json({ received: true }); // fast 200 — no Stripe retry
}

Test this contract explicitly: simulate Stripe-style redelivery (same event twice with the same id), assert the handler returns 200 both times, and assert the queue processes the event exactly once.

CI/CD Testing Strategy

Test Matrix

What to Run Where

Environment Variable Strategy

# .env.local (development)
STRIPE_SECRET_KEY=sk_test_...
STRIPE_WEBHOOK_SECRET=whsec_test_...
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_test_...

# .env.production (production)
STRIPE_SECRET_KEY=sk_live_...
STRIPE_WEBHOOK_SECRET=whsec_live_...
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=pk_live_...

Never commit real keys. Use .env.local (gitignored) for development and a secrets manager for production.

Beyond Example Tests: Property-Based and Fault-Injection Testing

The test matrix above is example-based: every case is hand-written and asserts one specific scenario. Example tests are the foundation, but they have a ceiling — "we've exhausted example-based tests; property-based/fuzz testing finds what examples miss." Webhook handlers are stateful and concurrency-prone: duplicate deliveries, out-of-order events, and races between parallel webhook calls are exactly the bugs that hand-written examples miss because their timing masks the race.

Property-Based Invariants for the Webhook Handler

With fast-check (or Hypothesis in Python), assert invariants that must hold for any event the handler receives:

import { fc, it } from "fast-check";

// Invariant: no purchase is ever recorded for an unpaid or non-payment session
it("never records a purchase for non-payment sessions", () => {
  fc.assert(
    fc.property(
      fc.record({
        mode: fc.constantFrom("payment", "subscription", "setup"),
        payment_status: fc.constantFrom("paid", "unpaid", "no_payment_required"),
        id: fc.uuid(),
      }),
      (session) => {
        const handled = handleWebhook({
          type: "checkout.session.completed",
          data: { object: session },
        });
        const expected = session.mode === "payment" && session.payment_status === "paid";
        expect(handled.purchaseRecorded).toBe(expected);
      },
    ),
  );
});

// Invariant: idempotency — duplicate delivery never double-records
it("is idempotent under duplicate delivery", () => {
  fc.assert(
    fc.property(fc.uuid(), (sessionId) => {
      const event = {
        type: "checkout.session.completed",
        data: { object: { id: sessionId, mode: "payment", payment_status: "paid" } },
      };
      handleWebhook(event);
      handleWebhook(event); // Stripe can deliver twice — or 100x
      expect(purchasesFor(sessionId)).toHaveLength(1);
    }),
  );
});

What this buys you: the mode/payment_status guard from the Critical Guard section stops being a remembered rule and becomes an enforced invariant. This is the quality principle that keeps paying off in production systems: a guard that exists but isn't enforced is worse than no guard — it creates false confidence.

Model-Based Stateful Testing of the Checkout Lifecycle

A checkout session is a state machine: open → completed | expired | canceled, with payment_status transitioning independently (SEPA arrives unpaid first). Model the lifecycle, then let the framework drive random command sequences (create, complete, expire, duplicate-webhook) against both the model and your real handlers — the states must match after every step. This is what caught a real bug in practice: two concurrent webhook deliveries both passed the duplicate check, then both recorded a purchase. A serial test never sees the race; a stateful fuzz run does.

Seeded Fault Injection

Add a seeded fuzz layer that throws everything at the handler:

• Replayed webhooks — the same signature delivered 2×, 5×, 100× (idempotency under load)
• Out-of-order events — invoice.paid arriving before checkout.session.completed
• Stale signatures — timestamps older than the 5-minute tolerance (replay protection)
• Corrupt payloads — truncated JSON, wrong signature format, oversized metadata (500-char limit)

Every failure is shrunk to a minimal reproducer (fast-check does this automatically), and that reproducer becomes a regression test. The regression-per-fix rule is non-negotiable: a fuzz finding without a regression test is a bug you have seen once and will see again.

Quality Gates for the Payment Pipeline

• Coverage gates: ≥ 95% lines / ≥ 90% branch on the webhook handler, checkout creation, and token verification — enforced in CI, not aspirational
• 3× stable: run the full suite three times before a release; a flaky webhook test is a signal, not a nuisance
• Mutation testing (Stryker) on the guards: kill the payment_status check or the signature verification and confirm the tests fail

Security Checklist for Stripe Integrations

Webhook Verification

Always verify webhook signatures. Never trust raw webhook payloads.

import crypto from "crypto";

function constructWebhookEvent(body: string, signature: string) {
  const webhookSecret = process.env.STRIPE_WEBHOOK_SECRET!;
  if (!webhookSecret) throw new Error("Not configured");

  const elements = signature.split(",");
  const timestamp = elements.find((e) => e.startsWith("t="))?.slice(2);
  const sig = elements.find((e) => e.startsWith("v1="))?.slice(3);

  if (!timestamp || !sig) throw new Error("Invalid signature format");

  // Reject events older than 5 minutes (replay protection)
  const age = Math.floor(Date.now() / 1000) - parseInt(timestamp);
  if (age > 300) throw new Error("Stale webhook");

  const signedPayload = `${timestamp}.${body}`;
  const expected = crypto.createHmac("sha256", webhookSecret).update(signedPayload).digest("hex");

  if (sig !== expected) throw new Error("Signature mismatch");

  return JSON.parse(body);
}

Idempotency

Webhooks can be delivered multiple times. Always check for duplicates:

// Before processing
const existing = loadPurchases();
if (existing.some((p) => p.session_id === session.id)) {
  logger.info("Duplicate webhook — skipping");
  break;
}

Rate Limiting

Rate-limit all Stripe-facing endpoints:

// Create checkout — external API call
const isRateLimited = createRateLimiter(60_000, 10); // 10 per minute per IP

Cryptographic OTP

Don't use Math.random() for OTPs. Use the Web Crypto API:

export function generateOTP(): string {
  const buf = new Uint32Array(1);
  crypto.getRandomValues(buf);
  return String(100000 + (buf[0] % 900000));
}

Token Security

Download tokens must be:

• Signed (HMAC) — prevents tampering
• Time-limited (24 hours) — prevents indefinite reuse
• Bound to a session — prevents sharing across purchases
• Resolved server-side — prevents URL manipulation

Common Pitfalls

1. Metadata Size Limit

Stripe metadata values are limited to 500 characters. A cart with 20+ items can exceed this:

// ❌ Unbounded
metadata.items = JSON.stringify(items);

// ✅ Guard size
const itemsJson = JSON.stringify(items.slice(0, 20));
metadata.items = itemsJson.length > 490 ? itemsJson.slice(0, 487) + '..."' : itemsJson;

2. Subscription vs Payment Events

checkout.session.completed fires for BOTH payment and subscription checkouts. Your handler must check session.mode:

if (session.mode !== "payment") break; // subscriptions use customer.subscription.* events

3. Canceled Subscription State

customer.subscription.updated fires on any subscription change, including cancellation. Don't blindly clear canceled_at:

// ❌ Wrong — wipes cancellation date
canceled_at: undefined;

// ✅ Correct — preserve unless reactivated
canceled_at: sub.status === "active"
  ? undefined
  : sub.canceled_at
    ? new Date(sub.canceled_at * 1000).toISOString()
    : undefined;

4. Rate Limiting After Body Parsing

If your rate limiter runs after request.json(), an attacker can exhaust your server's resources before being throttled:

// ❌ Wrong — body parsed before rate check
const body = await request.json();
if (isRateLimited(ip)) return 429;

// ✅ Correct — rate check before parsing
if (isRateLimited(ip)) return 429;
const body = await request.json();

5. localStorage Access Without try/catch

In private browsing or when storage is blocked, localStorage.getItem() throws:

// ❌ Crashes in private browsing
const [email] = useState(() => localStorage.getItem(KEY));

// ✅ Safe
const [email] = useState(() => {
  try {
    return localStorage.getItem(KEY) || "";
  } catch {
    return "";
  }
});

Testing Checklist

Run through this checklist before every release:

• All unit tests pass (webhook, checkout, download, token)
• Back-to-back flow test passes (checkout → webhook → download)
• Test card 4242 succeeds end-to-end (Stripe CLI mode)
• Decline card 4000000000000002 handled gracefully
• Duplicate webhook delivery is idempotent
• Unpaid session (payment_status: unpaid) is skipped
• Subscription checkout (mode: subscription) is skipped
• Download token expires after time limit
• Metadata size guard works for 20+ item carts
• Rate limiting works on all Stripe endpoints
• OTP uses cryptographic random (not Math.random)
• Webhook signature verification works
• Production keys are NOT committed to git
• Stripe webhook endpoint is registered in Dashboard
• Property-based invariants run in CI (payment_status guard, idempotency)
• Seeded fuzz layer runs (replay, out-of-order, stale signature, corrupt payload)
• Every fuzz failure shrunk to a reproducer and added as regression test
• Webhook handler coverage ≥ 95% lines / 90% branch
• Suite runs 3× stable before release
• Webhook acknowledges fast; async processing dedupes retries
• Idempotency-key on checkout creation prevents duplicate sessions
• Dispute event (charge.dispute.created) handled and tested

Conclusion

Testing Stripe integrations isn't optional — it's a security requirement. A single vulnerability in payment handling can lead to inventory theft, customer data exposure, or revenue loss.

The pattern is always the same: never trust client input, verify everything server-side, and test edge cases that Stripe's happy path documentation doesn't cover.

The investment in comprehensive testing pays for itself the first time a webhook is replayed, a card is declined, or a customer disputes a charge. Build the testing infrastructure once, run it on every commit, and ship payments with confidence.