Stripe

// Test mode keys — safe for development, hit no real charges
sk_test_...   // secret key
pk_test_...   // publishable key (not needed for Conductor)

// Live mode keys — real money, real customers
sk_live_...   // secret key
pk_live_...   // publishable key

// NEVER use sk_live_ in development, CI, or staging environments.
// Test mode and live mode are completely separate environments:
// different customers, different charges, different subscriptions.

// Create a restricted key at:
// dashboard.stripe.com → Developers → API keys → Create restricted key

// Recommended minimal permissions for Conductor:
// Customers:           Read
// Charges:             Read
// PaymentIntents:      Write (if creating payments)
// Subscriptions:       Read + Write (if managing subscriptions)
// Invoices:            Read
// Products:            Read
// Prices:              Read
// Refunds:             Write (if issuing refunds)

// Restricted keys start with: rk_test_ or rk_live_

# Install the Stripe CLI for local webhook forwarding
brew install stripe/stripe-cli/stripe

# Log in
stripe login

# Forward webhooks to your local Conductor instance
stripe listen --forward-to http://localhost:3000/webhooks/stripe

# The CLI prints your webhook signing secret:
# > Ready! Your webhook signing secret is whsec_xxxxxxxx (^C to quit)

// Production webhook setup:
// 1. Go to dashboard.stripe.com → Developers → Webhooks
// 2. Click "Add endpoint"
// 3. Enter your public URL: https://yourdomain.com/webhooks/stripe
// 4. Select events to listen for (e.g., payment_intent.succeeded)
// 5. After saving, click "Reveal" under Signing secret
// 6. Copy the whsec_... value into Conductor config

{
  "plugins": {
    "stripe": {
      "secretKey": "sk_test_51xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
      "webhookSecret": "whsec_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
    }
  }
}

// Idempotency keys prevent duplicate operations on retries.
// Conductor automatically generates and attaches idempotency keys
// for all write operations (charge creation, refunds, etc.).
//
// For manual calls, pass an idempotency key as a parameter:
{
  "tool": "stripe.payment-intent.create",
  "amount": 2000,
  "currency": "usd",
  "idempotencyKey": "order_12345_attempt_1"
}
// Using the same key within 24 hours returns the original response
// without creating a duplicate charge.