Add a Stripe API key securely without exposing it in code

Lovable stores secrets in a secure location and makes them available only to server-side code, keeping them out of the browser.

When to use it

You're adding payment processing with Stripe and need to keep your API key safe from users.

Why it is worth it

Secrets exposed in frontend code are visible to anyone, so storing them securely prevents credential theft and unauthorized API access.

Before you start

1. Have a project started in Lovable with a basic page
2. Know your API key from your Stripe account

Paste this into Lovable's chat when you're building the payment processing page.

I'm building a subscription app. Users submit their credit card info and get charged $19.99 per month. I have a Stripe API key: sk_live_abcd1234efgh5678ijkl9012. Add a secure server function that accepts the card token from the frontend, charges the customer with Stripe, and stores the transaction ID in the database. The function should validate that the amount is exactly $19.99 before charging. Return the transaction ID on success or an error message if the charge fails. Make sure the Stripe API key is never sent to the frontend.

Swap Stripe with your payment provider, sk_live_... with your actual API key, and $19.99 with your subscription price.

What you get

A server function that charges customers securely without exposing your API key to the browser.