Nova Stripe Checkout Field Laravel Package

Getting Started

Before installing anything, confirm viability: this package was last released in August 2018, targets Laravel Nova 1.x, and is archived. It will not run on Nova 2/3/4 without rewriting the field. Treat it as a reference implementation, not a dependency.

If you are evaluating it on a legacy Nova 1.x app:

1. composer require depsimon/nova-stripe-checkout-field
2. Register the package service provider (2018-era packages often lack auto-discovery) in config/app.php.
3. Publish any package config: php artisan vendor:publish --provider="Depsimon\NovaStripeCheckoutField\..." — check the provider class for the exact tag.
4. Add Stripe credentials to .env: STRIPE_KEY (publishable) and STRIPE_SECRET (secret). Never pass the secret to the frontend; only the publishable key should be exposed in field meta.
5. Attach the field to a resource's fields() method and load the detail view of a record.

Where to look first, in order:

• composer.json — the hard version constraints on laravel/nova, stripe/stripe-php, and PHP tell you immediately whether it can coexist with your app.
• The field class in src/ — what fluent setters exist (plan, amount, currency, success/cancel URLs) and what it puts in meta().
• The package routes file — how the checkout session is created (AJAX endpoint, controller, middleware).
• The Vue component in resources/js/ — what the button does on click and where it redirects.
• Any config file — plan IDs, price mapping, success route.

First use case: put the field on an Order (or User) detail view, click the button in a test-mode Stripe account, pay with 4242 4242 4242 4242, and confirm both the redirect back to Nova and a checkout.session.completed webhook arrive. If that path works end to end, the package is at least minimally functional; only then consider production use.

Implementation Patterns

• Detail-only field. A checkout button belongs on the detail view. Guard with ->onlyOnDetail() and, if the field supports it, ->canSee() tied to a policy so unauthorized users never see a payment CTA.
• Configure via the field, not the DB. Typical legacy usage passes the plan/price and amount through fluent setters:

  StripeCheckout::make('Checkout')
      ->plan('plan_xxx')
      ->amount(4900)
      ->currency('usd')
  

  Amounts are in the smallest currency unit (cents). Keep plan/price IDs in config rather than hardcoding them in the resource.
• Create the session server-side. The button should hit a package (or your own) route that builds a Checkout Session with the secret key and returns the session URL/ID. The Vue component then redirects to Stripe. If the package's route is too rigid, register your own controller and point the field at it — the field is mostly a button, so replacing the endpoint is usually simpler than forking.
• Fulfillment via webhook, not the success URL. The success redirect only means the browser came back. Handle checkout.session.completed (and checkout.session.async_payment_succeeded for delayed methods) in a webhook controller, verify the Stripe signature, and update the order idempotently using the session ID as a unique key.
• Pass metadata through. Attach metadata (order ID, user ID, Nova resource ID) when creating the session so the webhook can find the right model without trusting the redirect.
• Combine with Nova Actions. Use the field as the "pay now" entry point, and use Actions for refunds, cancellations, and resends. Actions give you authorization, audit logging, and confirmation modals that a raw field button lacks.
• Success/cancel URLs. Point them back at the Nova detail route (signed URLs are ideal) so the operator lands on the updated record rather than a generic page.

Gotchas and Tips

• It is archived and Nova-1 era. Nova 4 moved to Vue 3 and changed the field/tool APIs; this package's compiled JS and field class will not work. Even on Nova 2/3, expect breakage. Budget for a rewrite, not an upgrade.
• Stripe API drift is the biggest risk. Since 2018, Stripe moved from Sources to PaymentIntents, made SCA/3DS mandatory for many regions, and changed Checkout Session parameters (payment_method_types, billing_address_collection, success URL requirements). Code written against the 2018 API will either error or silently misbehave in live mode.
• SDK version pinning. The package likely constrains stripe/stripe-php to an old major. That can conflict with Laravel Cashier or your own Stripe integration. Check composer why stripe/stripe-php before installing.
• Secret key leakage. Only the publishable key should appear in the field's meta(). Grep the source for STRIPE_SECRET/secret to confirm it is never serialized to the browser.
• CSRF and auth on the checkout route. Confirm the package route sits behind Nova's auth middleware and is a POST (or signed GET). An unauthenticated GET that creates sessions is an abuse vector — anyone who guesses the URL can generate Checkout Sessions against your Stripe account.
• Double clicks create duplicate sessions. Add a client-side disable-on-click and, if you own the controller, pass an idempotency key to Stripe.
• Test vs live mode confusion. Publishable and secret keys must match mode, and the webhook signing secret differs per endpoint. Most "it worked yesterday" failures are a key/webhook-secret mismatch.
• Button on index won't work. If the field renders unconditionally it may appear in index tables with no record context. Force onlyOnDetail().
• Debugging path: browser network tab for the field's AJAX call, php artisan route:list | grep -i stripe to find the package endpoint, storage/logs/laravel.log for controller errors, and the Stripe Dashboard's Events log to see whether a session was created at all.
• Extension points, if you keep it: subclass the field class to override meta() and options, override or replace the Vue component to change button behavior, and swap the package route for your own controller. Because the package is small and unmaintained, a 100-line custom Nova field plus a checkout.session.completed webhook handler is usually a safer long-term choice than depending on it.