360 Secure SkillHub
360 安全技能中心

Polsia Stripe Payments

面向在托管平台上搭建网站的开发者:用平台提供的 MCP 工具生成一次性或订阅支付链接,支付成功页需每 1500ms 轮询最多 10 次,再用环境变量中的凭据在服务端调用验证接口并按 sessionId 做幂等履约。文档明确禁止设置 Stripe 密钥、安装 Stripe SDK 或自行搭建 webhook。

agentlevier
agentlevier
热度 8.70
最近更新 2026-07-02 06:32:46
分类:开发依赖:MCP 服务 / 第三方 API应用场景:API 集成 / 代码生成 / 财务 / 工作流

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add polsia-stripe-payments
Metadata
name
stripe-payments
description
Accept payments on a Polsia-built site via Stripe Connect payment links, then verify them server-side — no Stripe SDK, no webhooks, no STRIPE_SECRET_KEY.

Stripe Payments

Accept card payments through the company's auto-provisioned Stripe Connect account. You create payment links with MCP tools, then verify completed payments server-side. No Stripe SDK, no webhook setup, no STRIPE_SECRET_KEY.

How the money works

Every company has a Stripe Connect (Express) account. Polsia takes 20% platform fee, company keeps 80% (minus Stripe processing fees). Payouts are daily to their bank.

The account is RESTRICTED until owner finishes Stripe onboarding on the Polsia Payments page. Until then it cannot take payments.

NO bring-your-own-Stripe. Do NOT set STRIPE_SECRET_KEY, do NOT npm install stripe, do NOT build webhooks.

1. Create Payment Link

Call the MCP tool with name, amount, and success_url pointing at YOUR app with {CHECKOUT_SESSION_ID} placeholder.

Always pass success_url. Without it, the buyer is redirected to Polsia, not your app.

One-time fixed price: create_payment_link. Recurring: create_subscription_link.

2. Success Page — Poll, Don't Verify Once

The payment record is written asynchronously (Stripe to Polsia webhook, ~1s+ after redirect). A single synchronous verify on the success page usually returns verified:false. Render a loading page and poll every 1500ms up to 10 times.

3. Verify Server-Side

GET process.env.POLSIA_API_BASE_URL + '/api/company-payments/verify?session_id=' + sessionId Auth: Authorization: Bearer process.env.POLSIA_API_KEY

Use POLSIA_API_BASE_URL (NOT POLSIA_API_URL which points at AI proxy). Make fulfillment idempotent, keyed on sessionId.

DO NOT

  • Set STRIPE_SECRET_KEY or install Stripe SDK
  • Use POLSIA_API_URL for payment endpoints
  • Verify only once on success page — poll
  • Hardcode buy.stripe.com links