Stripe Global COD to Prepaid Integration

Stripe Checkout Sessions Engine

135+ Currencies • Apple Pay, Google Pay, Visa, Mastercard, Amex

HMAC Verified checkout.session.completed

How Global COD Conversion Operates

When an international courier signals a delivery failure, ZeroRTO delivers an instant checkout discount link:

1. Delivery Failed (COD) Customer unavailable

2. Stripe Session Link Instant Apple Pay / Card URL

3. Order Marked PREPAID Zero cash risk / Guaranteed delivery

2. How to Retrieve Secret Key & Webhook Signing Secret

You need two secure keys from your official Stripe Dashboard:

1. Stripe Secret Key

Starts with sk_live_... found under Developers > API keys > Secret key. Authorizes session creation.

2. Webhook Signing Secret

Starts with whsec_... obtained after registering the webhook endpoint under Developers > Webhooks.

Log in to your Stripe Dashboard.
In the top right, navigate to Developers > API keys.
Reveal and copy your Secret key (starts with sk_live_).
Do not use Publishable keys (pk_live) for server-side link generation.

3. Exactly Where to Paste in the ZeroRTO Plugin

Open your WordPress Admin > click ZeroRTO > open the COD to Prepaid tab:

Step 1: Enable Toggle

COD to Prepaid Conversion Engine

Step 2: Set Discount Value Prepaid Conversion Discount Value ($)

Step 3: Select Stripe

Stripe (Cards / Apple Pay) Selected Global Active

Step 4: Secret Key Stripe Secret Key

sk_live_••••••••••••••••

Step 5: Signing Secret Stripe Webhook Signing Secret

whsec_••••••••••••••••

4. Register Webhook in Stripe Dashboard

Stripe must notify your store immediately when a customer pays via Apple Pay or Card:

https://yourstore.com/wp-json/rescuedrop/v1/payment-webhook/stripe

In your Stripe Dashboard, go to Developers > Webhooks > Add destination / Add endpoint.
In the Endpoint URL field, paste your copied ZeroRTO endpoint URL above.
Click Select events to listen to > search and check: checkout.session.completed.
Click Add endpoint.
Under the newly created endpoint details, locate Signing secret, click Reveal, and copy the key (starts with whsec_).
Paste this whsec_... key into Step 5 in your ZeroRTO settings!

5. Cryptographic Stripe-Signature Header Security

Eliminating Replay Attacks & Forgery

ZeroRTO parses the Stripe-Signature header (containing timestamp t and signature v1). The payload is re-signed using your private whsec_... secret and verified with timing-attack-safe hash_equals(). Forged webhooks or tampered totals are rejected instantly!

Stripe Global COD-to-Prepaid Setup Checkout Sessions v1