From stripe-mpp
Provides MPP patterns for security, replay protection, HMAC binding, receipt validation, error handling, retries, TLS, and monitoring. Use when architecting secure payment systems or debugging production issues.
npx claudepluginhub orcaqubits/agentic-commerce-skills-plugins --plugin stripe-mppThis skill is limited to using the following tools:
**Fetch live docs**:
Guides Payload CMS config (payload.config.ts), collections, fields, hooks, access control, APIs. Debugs validation errors, security, relationships, queries, transactions, hook behavior.
Acquire memory dumps from live systems/VMs and analyze with Volatility 3 for processes, networks, DLLs, injections in incident response or malware hunts.
Provides x86-64/ARM disassembly patterns, calling conventions, control flow recognition for static analysis of executables and compiled binaries.
Fetch live docs:
https://paymentauth.org/ for canonical security and encoding requirementssite:datatracker.ietf.org draft-ryan-httpauth-payment for the latest RFC drafthttps://docs.stripe.com/payments/machine/mpp for production integration patternssite:npmjs.com mppx for error handling and retry APIsThe 32-byte secretKey is the server's core security primitive:
openssl rand -hex 32const mppx = Mppx.create({
secretKey: process.env.MPP_SECRET_KEY, // 32-byte hex
methods: [/* ... */],
});
Single-use proof semantics prevent double-payment:
MPP mandates TLS 1.2+ (TLS 1.3 recommended):
Cache-Control: no-store on all responses containing credentialsRFC 8785 canonical JSON is required for deterministic encoding:
MPP uses RFC 9457 Problem Details for error responses:
{
"type": "https://paymentauth.org/problems/payment-required",
"status": 402,
"detail": "Payment is required.",
"challengeId": "..."
}
Error types:
payment-required — Normal challenge, no payment attempted yetverification-failed — Invalid proof of paymentpayment-expired — Challenge or credential expiredmalformed-credential — Cannot parse the credentialClient retry strategy:
payment-required — Normal flow, fulfill and retryverification-failed — Do NOT retry with same credential (likely invalid)payment-expired — Request a fresh challengemalformed-credential — Fix credential encoding, do not retry blindlyThe Payment-Receipt header proves delivery:
Even with payments, implement rate limiting:
Retry-After header when exceededRetry-After, add jitterMPP_SECRET_KEY — 32-byte hex, rotate periodicallySTRIPE_SECRET_KEY — Stripe API key, never in codeWALLET_PRIVATE_KEY — Crypto wallet key, use key management service.env files for development, secrets manager for production/openapi.json, /llms.txt) — cache aggressivelyCache-Control: no-store)Fetch the latest MPP specification and IETF draft for current security requirements, encoding rules, and best practices before implementing.