best-practices_skill

Overview

This skill is a concise, practical guide for integrating Dodo Payments into SaaS and AI products. It covers environment setup, SDK installation, core concepts like products and checkout sessions, webhook verification, and common flows for one-time payments and subscriptions. Use it to accelerate secure, production-ready payment integrations and reduce engineering overhead. The guidance focuses on concrete steps and patterns you can apply immediately.

How this skill works

The skill inspects integration needs and provides step-by-step instructions for configuring API keys, SDK clients, checkout sessions, and webhook handlers. It explains verification of webhook signatures, error handling patterns, testing in test_mode, and recommended dashboard workflows. Examples include TypeScript/JavaScript, Python, Go, and PHP snippets plus framework integration for Next.js and Express.js.

When to use it

• Building checkout flows for one-time purchases or subscription billing
• Adding webhook-driven fulfillment and subscription lifecycle handling
• Setting up secure server-side API access with environment variables
• Testing payments and webhooks in local or staging environments
• Integrating a customer portal for subscription self-management

Best practices

• Store API keys in environment variables and never expose them client-side
• Verify webhook signatures with timing-safe comparison to prevent tampering
• Use test_mode and test keys for development; rotate keys before production
• Implement exponential backoff for rate limiting (429) and robust error handling
• Redirect users to Dodo checkout URLs and handle success via webhooks and return_url

Example use cases

• Create a checkout session for a one-time product and fulfill access on payment.succeeded
• Create a subscription checkout with a trial period and activate access on subscription.active
• Expose an API route in Next.js or Express to create checkout sessions server-side
• Generate customer portal sessions to let users update payment methods and subscriptions
• Use ngrok during local development to receive and verify webhook events