Stripe & PayPal

Before connecting a provider

Payments go directly to the store owner’s Stripe or PayPal account. Open Payments → Set up payment providers to enter your own credentials. Checkout only offers enabled providers.

Craftly manages the service and webhook URLs. Use the provider-specific webhook URL displayed in your payment settings. Secret fields are encrypted. Leaving a credential blank preserves its saved value.

Connect Stripe

Craftly uses hosted Stripe Checkout. It does not require a publishable key in its payment settings.

1. In your Stripe account, obtain a secret API key. Begin with an sk_test_ key for testing; use sk_live_ for real payments.
2. Copy the Stripe webhook URL displayed by Craftly. Create that endpoint in Stripe for checkout.session.completed, checkout.session.async_payment_succeeded, charge.refunded, refund.updated, charge.dispute.created, charge.dispute.updated and charge.dispute.closed.
3. Enter the secret API key and webhook signing secret (whsec_…) in Craftly.
4. Enable Stripe, save, then test a checkout using Stripe test mode before switching to live credentials.

Connect PayPal Business

1. In Payment providers, choose PayPal Business. Create a REST app in the PayPal developer dashboard using your Business account. Start with a sandbox app.
2. Copy the PayPal webhook URL displayed by Craftly and subscribe it to CHECKOUT.ORDER.APPROVED, PAYMENT.CAPTURE.COMPLETED, PAYMENT.CAPTURE.REFUNDED, CUSTOMER.DISPUTE.CREATED, CUSTOMER.DISPUTE.UPDATED and CUSTOMER.DISPUTE.RESOLVED.
3. Enter that app’s client ID, client secret and webhook ID. Keep Use sandbox for test payments enabled while testing.
4. Enable PayPal and save. When ready for real payments, replace all credentials and the webhook ID with those from your live app, and turn sandbox off.

Connect PayPal Legacy

Legacy uses PayPal payment buttons and IPN instead of API credentials. Your PayPal account must be eligible for commercial payments; account and country requirements still apply, and PayPal may require a Business account. Legacy does not bypass verification or account restrictions.

New checkouts use the selected integration. Existing Legacy orders keep their original recipient and environment, even if you change settings. Business API credentials are retained when switching to Legacy so existing Business checkouts and notifications can still complete. Leave their original webhook active.

A browser return does not confirm a payment. Craftly verifies IPN directly with PayPal, then matches the recipient, currency, invoice and full order total. Pending payments wait for a Completed notification. Duplicate notifications cannot deliver the order twice. A verified successful partial or full refund runs refund actions once; a verified bank chargeback runs chargeback actions once. Internal buyer enquiries and canceled reversals do not run purchase actions again.

1. Open Payments → Set up payment providers and choose PayPal Legacy from PayPal integration.
2. Enter the primary email address of the PayPal account receiving payments. For testing, use a sandbox seller’s primary email and keep Use sandbox for test payments enabled.
3. Copy your store’s IPN notification URL. In PayPal account settings, find Instant payment notifications (under Notifications or Seller tools), choose the IPN settings, enter the URL, enable receiving messages and save.
4. Enable PayPal in Craftly and save. Complete a sandbox purchase using a different buyer account and check both payment status and game delivery. A simulator notification is not a substitute for testing the full buyer checkout.
5. For real payments, enter your live account’s primary email, configure IPN on that account, turn sandbox off and save.

Payment confirmation and refunds

Orders remain pending until Craftly verifies the provider’s payment, amount and currency on the server. Returning to a success page alone does not queue delivery. Free orders need no provider charge. Demo store checkouts are explicitly simulated.

The refund control records the refund and queues its saved refund actions. Issue the actual refund in your provider’s dashboard first; verified refund webhooks can record it automatically. Receipt emails and automatic provider refunds are not available in this build.