Complete walkthrough for enabling Stripe Checkout + Stripe Subscriptions in QAFlow.

1. Get Your Stripe API Keys

1. Sign up at dashboard.stripe.com
2. Developers → API keys → copy Publishable key (pk_test_... or pk_live_...) and Secret key (sk_test_... or sk_live_...)

2. Enable Stripe in QAFlow

1. Admin → Payment Gateways → find Stripe
2. Toggle Enabled
3. Paste both keys
4. Choose mode: Test (use pk_test/sk_test) or Live
5. Save

3. Configure Webhook (Required for Subscriptions)

Stripe needs to tell QAFlow when a subscription renews, fails, or is cancelled.

1. Stripe Dashboard → Developers → Webhooks → Add endpoint
2. Endpoint URL: https://your-domain.com/webhook/stripe
3. Select events to listen to:
   • checkout.session.completed
   • invoice.paid
   • invoice.payment_failed
   • customer.subscription.deleted
   • customer.subscription.updated
4. Copy the Signing secret (whsec_...)
5. Back in QAFlow → Payment Gateways → Stripe → paste the signing secret into Webhook Secret
6. Save

4. Create Pro Membership Plans

1. Admin → Pro Memberships → New Plan
2. Enter: name, monthly price, yearly price, features included
3. Toggle Active
4. Save — QAFlow auto-creates the matching Stripe Price objects

5. Test the Flow

With mode set to Test:

1. Log in as a non-admin user
2. Go to /pro — click Subscribe
3. On Stripe Checkout, use test card: 4242 4242 4242 4242, any future expiry, any CVV, any ZIP
4. Complete checkout
5. Back in QAFlow, user should now show as "Pro" in admin Users panel

Going Live

1. Activate your Stripe account (business details, bank account)
2. Switch to Live keys in Stripe Dashboard
3. Update QAFlow: paste live keys, set mode to Live
4. Update webhook endpoint in Stripe Dashboard to use live signing secret
5. Update QAFlow Webhook Secret accordingly

Common Issues

• Webhook 400 errors — Signing secret mismatch. Re-copy from Stripe Dashboard.
• "No such price" error — Delete plan and re-create so Stripe creates fresh Price IDs.
• Subscriptions not renewing — Webhook endpoint must be publicly reachable (no Basic Auth, no firewall blocks).