Stripe/PayPal secrets

Set up your PayPal/Stripe keys.

Create a Stripe and/or PayPal account and read the Stripe and PayPal documentation on how to get the keys.

Each provider gives you two sets of keys, one for testing and one for real payments. Merx knows both under their own option names and picks between them with the production option, so a server only ever needs the set it actually uses — see Testing and production.

Stripe keys

stripe.test.publishable_key and stripe.live.publishable_key identify your account in the browser. They aren’t secret — the publishable key goes into your checkout template, see Stripe Elements.
stripe.test.secret_key and stripe.live.secret_key are what actually charge money. Server only.
stripe.webhook_signing_secret verifies that a webhook really came from Stripe. There’s only one, so it holds the test secret while you’re testing and the live one afterwards. See Stripe webhooks.

PayPal keys

paypal.sandbox.clientID and paypal.live.clientID identify your PayPal app.
paypal.sandbox.secret and paypal.live.secret go with them. Server only.

Where to put them

Kirby reads three config files, each overriding the one before it:

/site/config/config.php  →  config.[your-domain].php  →  env.php

env.php wins over both others and is meant for exactly this. Keep it out of your repository, put it on each server by hand, and give every environment its own.

/site/config/env.php — development machine or test server

<?php

return [
  'wagnerwagner.merx.stripe.test.publishable_key' => 'pk_test_xxx…',
  'wagnerwagner.merx.stripe.test.secret_key' => 'sk_test_xxx…',
  'wagnerwagner.merx.stripe.webhook_signing_secret' => 'whsec_xxx…',
  'wagnerwagner.merx.paypal.sandbox.clientID' => 'xxx…',
  'wagnerwagner.merx.paypal.sandbox.secret' => 'xxx…',
];

/site/config/env.php — live server

<?php

return [
  'wagnerwagner.merx.production' => true,
  'wagnerwagner.merx.license' => 'MERX2-XXXXXXX-XXXXXXX',
  'wagnerwagner.merx.stripe.live.publishable_key' => 'pk_live_xxx…',
  'wagnerwagner.merx.stripe.live.secret_key' => 'sk_live_xxx…',
  'wagnerwagner.merx.stripe.webhook_signing_secret' => 'whsec_xxx…',
  'wagnerwagner.merx.paypal.live.clientID' => 'xxx…',
  'wagnerwagner.merx.paypal.live.secret' => 'xxx…',
];

production belongs in the same file, because a live server with live keys but without it reads the test keys — which are not there — and every payment fails. Keeping it here rather than in config.php is also what stops your development machine from charging real cards.

The signing secret appears in both, with a different value: there is one option for it, and the webhook you create in Stripe’s test mode has a different secret from the live one.

/.gitignore

/site/config/env.php

Anyone who has your live secret key can charge cards and issue refunds on your account. Never commit it, never send it through a chat or a ticket, and if it does end up somewhere it should not, roll it in the provider’s dashboard rather than hoping nobody noticed.

Kirby docs: multi-environment setup

Next, learn how to use these keys to create Stripe or PayPal payments.