How can I test that payments and unlocking actually work end to end before I let real users pay?

Use Stripe test cards and the Stripe CLI to run a real payment and webhook locally, with no real money. Here's the exact test-card numbers and listen command.

How Do I Test My Whole Payment Flow Before Real Users Hit It?

6 min read

You can test your entire payment flow end to end, with no real money, using Stripe test mode, the test card 4242 4242 4242 4242, and the Stripe CLI to forward webhooks to your local machine. That combination lets you pay like a real user, watch the webhook fire, and confirm the thing they paid for actually unlocks, all before anyone spends a real pound.

Why this matters for a vibe-coded app

Your AI agent almost certainly wired up a working checkout button. Clicking it, getting redirected to Stripe, and coming back with a success page looks like a finished payment flow. It isn't. The part that actually gives the user what they paid for happens after the redirect, when Stripe sends a webhook to your server saying "this payment succeeded." The agent built the visible half because that is what you asked for and what shows up in the demo. The invisible half, the webhook that flips a user to "paid," is the part that silently doesn't work, and you only find out when a real customer emails you saying they were charged and got nothing.

Testing before launch means driving the whole loop yourself, not just the button.

How to check

Ask yourself: after a test payment, does the user's record in your database actually change to "paid," and does the paid feature unlock? If you have never watched that happen, you have not tested your payment flow. Redirecting back to a "thank you" page proves nothing, because that page can show regardless of whether the webhook ever landed.

The fix: run a real test payment locally

Confirm you are in test mode. Your keys should start with pk_test_ and sk_test_, not pk_live_ / sk_live_. Test mode uses fake money and a separate dashboard. If you are unsure which mode you are in, read Stripe test mode vs live mode first.
Install the Stripe CLI and forward webhooks to your machine. Real Stripe webhooks cannot reach localhost, so the CLI tunnels them for you:
```
stripe login
stripe listen --forward-to localhost:3000/api/stripe/webhook
```
Point the path at your own webhook route. The CLI prints a signing secret like whsec_...; set that as your webhook secret in your local env so signature checks pass.
Pay with a test card. Open your checkout and use:
- 4242 4242 4242 4242, succeeds cleanly.
- Any future expiry (e.g. 12/34), any 3-digit CVC, any postcode.
For failure paths, use 4000 0000 0000 0002 (card declined) and 4000 0000 0000 9995 (insufficient funds) so you can see how your app behaves when a card is rejected.
Watch the webhook arrive. In the stripe listen terminal you should see checkout.session.completed (or payment_intent.succeeded) come through, forwarded to your route, returning 200. A non-200 means your handler errored and the unlock never happened.
Confirm the unlock in your database. Open the actual user row and verify the field your app checks, is_paid, plan, credits, whatever it is, truly changed. This is the step that proves the loop is closed.
Trigger events without clicking, to test fast. You can replay a webhook on demand:
```
stripe trigger checkout.session.completed
```

The trap to avoid

Do not treat the success-page redirect as proof of payment, and do not unlock access based on the redirect. The redirect is controlled by the browser, so it can be reached without a real payment, which is exactly how a user can fake a successful checkout. See can a user fake a successful payment. The webhook, verified with its signing secret, is the only trustworthy signal that money moved. If your unlock logic lives on the success page instead of the webhook handler, you have tested the wrong half.

Where this fits

Payments are the one flow where a silent failure costs you money and trust at the same time, and it is invisible in every demo. Running the full test-card loop locally is the cheapest insurance you can buy before launch. The free Readiness Report checks whether your webhook is actually wired to your unlock logic on your real project, and flags it if a payment can succeed while nothing changes. If you would rather have the gaps fixed in order and verified for you, that is what the Finishing Pass is for.