skills.rest
Simon-YHKim
Simon-YHKimCOMMUNITY
Explore all skills by this author →
GitHub

paid-api-guard

Audits paid third-party API integrations with a six-layer defense checklist and adversarial tests.

Updated Apr 5, 2026
Search Tags:#stripe#idempotency#payment integration#api security#key rotation#security checklist#webhook verification
One-click install
npx skills add https://github.com/Simon-YHKim/eject-button --skill paid-api-guard-simon-yhkim
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: paid-api-guard
Source: https://github.com/Simon-YHKim/eject-button/tree/main/.claude/skills/paid-api-guard
Command: npx skills add https://github.com/Simon-YHKim/eject-button --skill paid-api-guard-simon-yhkim

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Integrating paid APIs like Stripe, Toss, Twilio, or Google Maps exposes your app to leaked keys, webhook forgery, duplicate charges, and cost explosions. This Skill gives you a structured security review so you catch these risks before production. ## Core Features & Use Cases - 6-Layer Defense Checklist: Covers network boundary (BFF isolation), HMAC signing and idempotency, abuse detection, payment hardening, key-leak response, and observability logging. - 5 Adversarial Tests: Verifies no secrets in frontend bundles, blocks direct API calls, enforces idempotency on duplicate payments, rejects forged webhook signatures, and triggers anomaly detection on cost spikes. - API Design Review: Evaluates protocol choice (REST, GraphQL, tRPC, gRPC), pagination, N+1 queries, error formats, and versioning strategy. - Use Case: Before launching a Stripe checkout flow, run this Skill to confirm webhook signatures are verified on the raw body, amounts are recalculated server-side, and Idempotency-Key headers prevent duplicate charges. ## Quick Start Ask the agent to audit your Stripe payment integration for security risks and produce the six-layer defense checklist.

Frequently Asked Questions about paid-api-guard

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I secure a Stripe payment integration?▼

Secure Stripe integration by routing calls through a BFF layer, verifying webhook signatures on the raw request body, requiring Idempotency-Key headers on payment endpoints, and recalculating amounts server-side from database prices. Never expose secret keys in frontend bundles.

How do I verify Stripe webhook signatures correctly?▼

Verify webhook signatures against the raw request body using stripe.webhooks.constructEvent with your webhook secret. Parsing the JSON first and re-serializing it breaks the signature, so always pass the unparsed body string.

How do I prevent duplicate charges with idempotency keys?▼

Require an Idempotency-Key header on every payment endpoint and store processed keys in Redis with a TTL. For webhooks, deduplicate by event ID so the same Stripe event is never processed twice.

How do I detect leaked API keys in my frontend bundle?▼

Build the app and grep the output for patterns like sk_live, pk_live, or provider secret names; the expected result is zero matches. Keep secrets in server environment variables only and never use NEXT_PUBLIC_ prefixes for them.

What should I do when an API key is leaked?▼

Follow an incident playbook: rotate the key immediately, assess the blast radius from usage logs, then notify affected users. Prevent recurrence with GitHub push protection, trufflehog pre-commit hooks, canary keys, and 90-day rotation.

When should I choose REST vs GraphQL vs tRPC for an API?▼

Choose REST for cacheable public APIs, GraphQL for complex nested client-driven queries with DataLoader to avoid N+1, tRPC for type-safe full-stack TypeScript internal APIs, and gRPC for low-latency service-to-service communication.

Related Skills

Explore More Software Engineering Skills→
FortiumPartnersFortiumPartners

building-integrations

Integrate third-party APIs in .NET with adapters, webhooks, and Polly.

Official
Advanced
latestaiagentslatestaiagents
5

production-rag-checklist

Provide a production deployment checklist for RAG systems covering pipelines, monitoring, and security.

Official
Advanced
aaronbassettaaronbassett

security-core

Implement and audit application security across TypeScript, Python, and Rust.

Community
Advanced
NOMARJNOMARJ

stripe-integration

Integrate Stripe payment processing with subscriptions and webhook event handling.

Official
Advanced