Stripe Payments in Flutter with Supabase Edge Functions: The Complete Flow
Take payments in your Flutter app with Stripe + Supabase: create PaymentIntents in a Deno Edge Function, confirm on-device with flutter_stripe, verify webhook signatures with the raw body — plus idempotency, the customers table pattern, and subscriptions.
TL;DR: Never put your Stripe secret key in the Flutter app. The secure pattern: a Supabase Edge Function creates the PaymentIntent (using the secret key server-side), your Flutter app confirms it on-device with flutter_stripe , and a second Edge Function receives Stripe's webhook, verifies the cryptographic signature against the raw request body , and marks the order paid in Postgres. This guide covers the full loop plus the idempotency and subscription handling most tutorials skip. What you'll learn Why the secret key must never leave your Edge Function The three-function architecture: create intent → confirm on device → webhook confirms Verifying Stripe webhook signatures in Deno (the raw-body trap) The customers table pattern linking Stripe customers to Supabase users Testing webhooks locally with the Stripe CLI What tutorials skip: idempotency, subscriptions vs one-time, test/live discipline The architecture: three steps, two functions Payment processing is asynchronous — Stripe tells you about success *later*, via webhook. The full loop: Create — Flutter calls Edge Function create-payment-intent , which uses the Stripe secret key to create a PaymentIntent and returns its client secret. Confirm — Flutter passes the client secret to flutter_stripe , which collects card details and confirms the payment on-device (handling 3D Secure etc.). Fulfill — Stripe POSTs a webhook event to Edge Function stripe-webhook ; the function verifies the signature and updates your database (order → paid, subscription → active). Your Flutter app never sees the secret key. Your database never trusts an unverified webhook. Those are the two rules everything else serves. Step 1: The customers table Link Stripe's world to your users once, then forget about it: create table…