Payments

Take payments from your app

The browser never sets the amount. The server recalculates the order total from your own data and stops the payment when the two do not match.

Korean card providers and KakaoTalk business messages are not offered by Lovable (feature comparison, 2026-07-26). We have not signed a Korean merchant contract yet either, so this page says exactly what runs today and what does not.

What it is

Money is the part of an app you cannot get slightly wrong. A wrong total is a loss, and a total applied twice puts your stock out of step with your ledger.

So the checkout call carries an order reference, not a price. The server reads the order back out of your database, recalculates the total, and compares it with the price registered at the payment provider. If the two disagree, no checkout session is created.

Paid events are only accepted when the signature checks out, and each one is applied to the order a single time. A replayed notification changes nothing.

How to use it

Step 1. Store the payment keys

Your provider keys go into the project vault, never into the app source. The server loads them at the moment a checkout starts.

Step 2. Start a checkout from an order

The app sends the order reference and an idempotency key. Amount, currency, and line items come from the server. The checkout window closes after 30 minutes.

Step 3. Apply the result

Signed provider events update the order. Held orders release themselves when their reservation expires, so nothing stays stuck.

What we measured

3Providers with signature checks in code
30 minCheckout session lifetime
onceTimes a repeated paid event is applied
0Amounts the browser can set

These come from the payment code itself. No money has moved through a live provider account yet.

What it does not do

Only Stripe opens a checkout

PortOne and Toss Payments have webhook signature verification in code. Opening a checkout window still runs through Stripe only.

Live payments are switched off

A merchant contract is still outstanding. Until it is signed no card is charged, and our own paid plans stay closed for the same reason.

No subscriptions inside generated apps

Your app can take a one-off payment. Recurring billing for your customers is not built.

No Korean cash receipts or escrow

Cash receipt issuance and escrow settlement are not in the code. You would handle those through your provider.