Skip to content
Back to skills

Paddle

ASecurity

Integrate Paddle payments with subscriptions, webhooks, checkout, and tax compliance.

  • 17 stars
  • 0 votes
  • 0 copies
  • 4 views
  • Added September 6, 2026
securityrusttestingdebuggingapisecurity

Works with

  • api

Security analysis

A100/100

Pro scans all 6 files and shows the line behind each finding

Scanned September 6, 2026

npx -y skills add clawic/skills --skill paddle --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Paddle?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Paddle
[![Security: A โ€” Skills Directory](https://www.skillsdirectory.com/api/skills/clawic-paddle/badge)](https://www.skillsdirectory.com/skills/clawic-paddle)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: Paddle
slug: paddle
version: 1.0.0
description: Integrate Paddle payments with subscriptions, webhooks, checkout, and tax compliance.
homepage: https://clawic.com/skills/paddle
changelog: Initial release with API reference, webhook handling, and checkout integration.
metadata:
  clawdbot:
    emoji: ๐Ÿ“
    requires:
      bins: []
    os:
    - linux
    - darwin
    - win32
    displayName: Paddle
---

## Setup

On first use, read `setup.md` for integration guidelines.

## When to Use

User needs to integrate Paddle for SaaS payments. Agent handles API calls, webhook verification, checkout setup, subscription management, and tax compliance configuration.

## Architecture

Memory lives in `~/Clawic/data/paddle/`. See `memory-template.md` for structure.

```
~/Clawic/data/paddle/
โ”œโ”€โ”€ memory.md     # API keys, environment, product IDs
โ””โ”€โ”€ webhooks.md   # Webhook endpoints and event handling
```

## Quick Reference

| Topic | File |
|-------|------|
| Setup process | `setup.md` |
| Memory template | `memory-template.md` |
| API endpoints | `api.md` |
| Webhook handling | `webhooks.md` |

## Core Rules

### 1. Always Use Sandbox First
- Test ALL integrations in sandbox before production
- Sandbox API: `https://sandbox-api.paddle.com`
- Production API: `https://api.paddle.com`
- Never skip sandbox testing for payment flows

### 2. Verify Webhook Signatures
- Every webhook MUST be verified before processing
- Use the webhook secret from Paddle dashboard
- Reject requests with invalid signatures immediately
- Log failed verifications for debugging

### 3. Handle Subscription States Correctly
| State | Meaning | Action |
|-------|---------|--------|
| `active` | Paying customer | Grant access |
| `trialing` | In trial period | Grant access, remind before end |
| `past_due` | Payment failed | Retry period, warn user |
| `paused` | User paused | Restrict access, allow resume |
| `canceled` | Subscription ended | Revoke access at period end |

### 4. Store Paddle IDs Correctly
- `customer_id` (ctm_xxx) โ€” unique per customer
- `subscription_id` (sub_xxx) โ€” unique per subscription
- `transaction_id` (txn_xxx) โ€” unique per payment
- `price_id` (pri_xxx) โ€” your pricing configuration
- Map these to your internal user/subscription records

### 5. Use Paddle Retain for Dunning
- Enable Paddle Retain in dashboard for failed payments
- It handles retry logic and customer communication
- Track `subscription.past_due` events but let Paddle retry first
- Only take action after `subscription.canceled` from failed payments

## Common Traps

- **Hardcoding price IDs** โ†’ Use environment variables, prices change between sandbox/production
- **Processing webhooks without verification** โ†’ Security vulnerability, anyone can fake events
- **Ignoring `past_due` state** โ†’ User loses access during retry window, bad UX
- **Not handling proration** โ†’ Confusing charges when users upgrade/downgrade mid-cycle
- **Testing with production keys** โ†’ Real charges, angry customers, refund headaches

## External Endpoints

| Endpoint | Data Sent | Purpose |
|----------|-----------|---------|
| https://api.paddle.com | Customer data, subscription info | Payment processing |
| https://sandbox-api.paddle.com | Test customer data | Sandbox testing |

No other data is sent externally.

## Security & Privacy

**Data that leaves your machine:**
- Customer email and name sent to Paddle for billing
- Payment amounts and subscription details
- IP addresses for tax calculation

**Data that stays local:**
- API keys stored in environment variables
- Webhook secrets never logged
- Internal user mappings

**This skill does NOT:**
- Store credit card numbers (Paddle handles PCI compliance)
- Access payment methods directly
- Share customer data with third parties beyond Paddle

## Trust

By using this skill, customer and payment data is sent to Paddle.
Only install if you trust Paddle with your billing data.

## Related Skills
More Clawic skills, get them at https://clawic.com/skills/<slug> (install if the user confirms):
- `billing` โ€” General billing patterns
- `payments` โ€” Payment processing
- `subscriptions` โ€” Subscription management

## Feedback

- If useful, star it: https://clawic.com/skills/paddle
- Latest version: https://clawic.com/skills/paddle

Files in this skill

  • SKILL.md4.2 KB
  • _meta.json164 B
  • api.md3.4 KB
  • memory-template.md1.2 KB
  • setup.md1.7 KB
  • webhooks.md4.5 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

View all in security โ†’

Comments

Loading commentsโ€ฆ

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.