Stripe PaymentIntent in Svelte/SvelteKit: stripe-js directly, server route mints the secret

TL;DR

// src/routes/api/payment-intent/+server.ts import Stripe from 'stripe'; import { STRIPE\_API\_KEY\_VALUE } from '$env/static/private'; import { json } from '@sveltejs/kit'; const stripe = new Stripe(STRIPE\_API\_KEY\_VALUE); export async function POST({ request }) { const { amount, currency } = await request.json(); const intent = await stripe.paymentIntents.create({ amount, currency, automatic\_payment\_methods: { enabled: true }, }); return json({ 'clientSecret': intent.client\_secret }); }

[script]
  import { onMount } from 'svelte';
  import { loadStripe } from '@stripe/stripe-js';

  let cardEl;
  let stripe, card;

  onMount(async () => {
    stripe = await loadStripe('YOUR_PUBLISHABLE_KEY_VALUE');
    card = stripe.elements().create('card');
    card.mount(cardEl);
  });

  async function pay() {
    const { clientSecret } = await fetch('/api/payment-intent', {
      method: 'POST',
      body: JSON.stringify({ amount: 2000, currency: 'usd' }),
    }).then((r) => r.json());
    const { error, paymentIntent } = await stripe.confirmCardPayment(clientSecret, {
      payment_method: { card },
    });
    if (error) console.log(error.message);
    else if (paymentIntent.status === 'succeeded') console.log('paid');
  }
[/script]

[div bind:this={cardEl}][/div]
[button on:click={pay}]Pay[/button]

Steps

1. - The secret key lives in $env/static/private, imported only by +server.ts files.

• bind:this gives stripe-js the DOM node; mount after loadStripe resolves.
• confirmCardPayment handles 3D Secure automatically.

When to use

You are seeing this: Svelte apps do not need a wrapper library. stripe-js works directly: a SvelteKit server route mints the PaymentIntent with the secret key, and the page component mounts a card element and confirms. Use this skill when you run into "Stripe PaymentIntent in Svelte/SvelteKit: stripe-js directly, server route mints the secret".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

stripe-js (loadStripe, elements, confirmCardPayment) is framework-agnostic and works in Svelte/SvelteKit directly (docs.stripe.com/stripe-js). SvelteKit server routes (+server.ts) hold the secret key; the page component only ever sees the client secret. Verified against live docs 2026-09-26.