Stripe secret keys do not belong in a frontend
Publishable keys start with pk_. Secret keys start with sk_, and restricted keys start with rk_. Only the publishable key is meant for the browser.
Stripe separates publishable keys from secret keys. A publishable key, pk_test_ or pk_live_, is what Stripe.js expects in the browser. A secret key, sk_test_ or sk_live_, can act on your Stripe account through the API. A restricted key, rk_, has a smaller set of permissions. The restriction does not make it safe to publish.
Coding agents sometimes paste the secret into a client component because the sample they generalized from was a server script. Search the repository and the built assets for sk_ and rk_. If one has been deployed, roll that key in the Stripe Dashboard and store the replacement in an environment variable that only the server reads.
Create Checkout on the server
Create the Checkout Session in a route handler or server action. Send the browser the session URL Stripe returns, not the API key that created the session. The webhook signing secret stays on the server. Verify the signature there before you trust the event. A test secret key cannot charge a live card, and it still authenticates as your account in test mode. Rotate it if it has been in client code, and do not copy it into a live deploy.