API keys
Allow-list of accepted Bearer tokens — include both the secret AND the publishable key the backend is configured with. Removing the backend’s key makes every call fail with the documented invalid_api_key error.
Webhook settings
The signing secret must match the backend’s Stripe webhookSecret admin setting — change it here to break the handshake on purpose.
PaymentIntents
Everything the backend created. Resending a webhook re-fires the event for the CURRENT state (duplicate-delivery testing).
Test cards
| Number | Behavior |
|---|---|
| 4242424242424242 | Succeeds (as does any other unlisted number) |
| 4000002500003155 | Requires 3D Secure |
| 4000002760003184 | Requires 3D Secure |
| 4000000000000002 | Declined — "Your card was declined." |
| 4000000000009995 | Declined — "Your card has insufficient funds." |
| 4000000000009987 | Declined — "Your card was declined." |
| 4000000000009979 | Declined — "Your card was declined." |
| 4000000000000341 | Declined — "Your card was declined." |
Webhook deliveries
Requests from the backend
Danger zone
wipes payments, logs and every runtime override — back to configured defaults