Never trust the client with your Stripe price

I was reading a Stripe tutorial last week and watched the author write amount: req.body.amount . That single line lets any user buy Premium for $1. It's also a common pattern in Stripe Checkout starter code. This post is about why, and how to make it impossible. The setup You're building a paywalled product. You wire up Stripe Checkout, follow a popular tutorial, ship it. Looks great. Tests pass. Users are paying. Six months later, someone opens DevTools, edits the request body, and pays €1 for