Generating Paystack Integration Code with Claude Code

The more context you give, the better the output. Compare these prompts:

Weak Prompt	Better Prompt
"Add Paystack to my Next.js app"	"Add Paystack checkout to my Next.js 14 App Router app. Needs: 1) Server action to initialize transaction (fetch product price from Prisma — do not trust client amount). 2) Webhook handler at /api/webhooks/paystack that validates HMAC signature using raw request body and x-paystack-signature header, verifies payment via GET /transaction/verify/:ref, updates order status in Prisma, returns 200 immediately. 3) Use PAYSTACK_SECRET_KEY from env. Include idempotency check to handle duplicate webhooks."
"Write a Paystack webhook"	"Write an Express webhook handler for Paystack charge.success events. Must: validate x-paystack-signature HMAC-SHA512 using raw body (not req.body), check for duplicate references in DB before processing, update order to 'paid', return 200 before database writes. Load secret from process.env.PAYSTACK_SECRET_KEY."
"Add subscriptions"	"Add Paystack subscription creation to my Express API. Customer provides email and plan_code. Server calls POST /subscription with customer email and plan_code. Return subscription_code and email_token to client. Handle the charge.success webhook to mark subscription as active. Include the subscription disable flow (POST /subscription/disable) for cancellation."

After generation, run this review checklist:

// Generated code review checklist — verify each item
var checklist = [
  'HMAC uses crypto.createHmac("sha512", secret).update(rawBody).digest("hex")',
  'rawBody collected as Buffer before JSON parsing',
  'Compares against req.headers["x-paystack-signature"]',
  'Amount in kobo: ngn_amount * 100',
  'Price fetched from DB, not from req.body.amount',
  'Duplicate reference check before processing',
  'Returns res.sendStatus(200) before async processing',
  'Secret key: process.env.PAYSTACK_SECRET_KEY (not hardcoded)',
  'HTTPS webhook URL (not HTTP)',
];

• Parsing body before HMAC — Claude Code sometimes writes const sig = req.headers['x-paystack-signature']; const body = JSON.stringify(req.body). This is wrong — HMAC must be computed on the raw byte buffer, before JSON parsing. Verify: app.use('/api/webhook', express.raw({ type: 'application/json' })) and use req.body directly (as Buffer).
• Amount in NGN not kobo — Claude sometimes generates amount: product.price where price is in NGN. Paystack expects kobo: amount: product.price_ngn * 100.
• Missing idempotency check — Paystack can deliver the same webhook twice. Generated code often processes the event without checking if the reference was already processed.
• Using deprecated endpoints — Claude's training data may reference older Paystack API endpoints. Verify endpoint paths against current Paystack documentation, especially for newer features like bulk transfers (POST /transfer/bulk).

See reviewing AI-generated payment code for the full checklist after generation.

Sign up for the McTaba newsletter