Examples / A Stripe checkout the iframe never holds a key for
A Stripe checkout the iframe never holds a key for
A working Stripe Checkout button that creates real hosted checkout sessions. The Stripe secret stays in a sodium-encrypted per-app vault on your server; the iframe references it as {{STRIPE_SECRET}} and the bridge substitutes it server-side before the request leaves your site.
BLOCK IFRAME OFFICIAL http-proxysecret-vaultiframe
What it uses
dsgo.http.fetch(url, init?) gated by permissions.http: ["api.stripe.com"] + secrets[] + required_secrets[]. 13-step pipeline: HTTPS-only, host allowlist, SSRF guard, no redirect follow, per-app rate limit, audit log.
Build something like this?
Install the free plugin and ship your own app in under a minute.