TransactKit-Pro configuration

Environment variables

Supported TransactKit-Pro environment variables
Variable	Default	Purpose
STRIPE_SECRET_KEY	Empty	Enables Stripe API operations
STRIPE_WEBHOOK_SECRET	Empty	Verifies POST /api/stripe/webhook
STRIPE_SUCCESS_URL	http://localhost:8080/api-test/success.html	Trusted Checkout success redirect
STRIPE_CANCEL_URL	http://localhost:8080/api-test/cancel.html	Trusted Checkout cancellation redirect
STRIPE_PORTAL_RETURN_URL	http://localhost:8080/api-test/index.html	Server-controlled Customer Portal return URL
STRIPE_AUTOMATIC_TAX_ENABLED	false	Default for payment and subscription Checkout; requests may override it
STRIPE_API_BASE	Empty	Local stripe-mock routing only; never set in production
DB_URL	In-memory H2 in MySQL mode	Selects H2 or an external JDBC database
DB_USERNAME	sa	Database username
DB_PASSWORD	Empty	Database password
SHUTDOWN_TIMEOUT	30s	Graceful shutdown phase timeout

Stripe sandbox setup

Use a restricted Stripe test-mode key suitable for the operations you exercise.
Create recurring Prices before subscription Checkout.
Configure the Customer Portal before creating Portal Sessions.
Configure Stripe Tax, Entitlement Features, Billing Meters, and promotion codes only when your integration uses them.
Use trusted application origins for success, cancel, and Portal return URLs.

H2 and MySQL

The default H2 database is in-memory and disappears when the process stops. For a persistent environment, create an empty MySQL database and a least-privilege application user, then set the three database variables.

Flyway applies V1-V3 automatically.
Hibernate runs in validate mode and never creates or updates the schema.
Back up production data before future migrations and test restore procedures.

.env

DB_URL=jdbc:mysql://localhost:3306/transactkit_pro
DB_USERNAME=your_database_username
DB_PASSWORD=your_database_password

Production configuration checklist

Use persistent MySQL with restricted credentials, backups, and restore testing.
Separate Stripe test and live credentials and supply secrets through the deployment platform.
Use HTTPS and trusted production redirect URLs.
Register the production webhook endpoint and protect its matching signing secret.
Block or omit /api-test/** and place Actuator health/info behind an appropriate operational boundary.
Add host authentication, tenant ownership checks, authorization, rate limits, audit policy, and safe logging.

Production security guidance