Payment credentials belong in the encrypted provider store and must never be committed to Free, Pro, Aurelia, documentation, screenshots or support tickets. The booking flow remains Book Now, a dedicated Payment step when required, server verification, then Booking Confirmation. Browser amounts and labels are advisory; the server room quote, currency, tax snapshot and transaction record are authoritative.
Before accepting a provider callback, verify its signature or authenticity, event identity, transaction identity, amount and currency. Write a settlement to the payment/refund ledger only after those checks pass. The callback handler must be idempotent: a retry or duplicate event cannot create a second payment, and a refund cannot be silently dropped. Payment success does not implicitly confirm a booking, and no payment event may recalculate live tax rules.
Stripe client secrets and Payment Element markup belong only on the signed, authorized payment step. Confirmation should read verified server state and must not embed card fields or secrets. Pay at hotel has no online transaction; PayPal, WooCommerce and other providers retain their own verification rules.
When diagnosing a failure, redact tokens, signatures, card data, customer details and raw gateway responses. Compare the saved transaction snapshot with the provider event, classify configuration versus provider failure, and replay only through a sandbox or an approved idempotent recovery action.