This one will take awhile and should be done post initial hackage release -- I could also imagine this being a couple of blog posts (ofc there will be a blog).
Cool idea: use effects to denote stripe things that are "Private" (re: server side only, like the private API key) which would make it wildly clear if it were ever to try to be used in the purview side of things.