The documentation you link for the stripe API key says
Authenticate your account when using the API by including your secret API key in the request. You can manage your API keys in the Dashboard. Your API keys carry many privileges, so be sure to keep them secret! Do not share your secret API keys in publicly accessible areas such GitHub, client-side code, and so forth.
How is this supposed to work safely, when you need to put the key in the package? Or is the enduser (who wants to donate) somehow expected to have their own API key?
Authenticate your account when using the API by including your secret API key in the request. You can manage your API keys in the Dashboard. Your API keys carry many privileges, so be sure to keep them secret! Do not share your secret API keys in publicly accessible areas such GitHub, client-side code, and so forth.
How is this supposed to work safely, when you need to put the key in the package? Or is the enduser (who wants to donate) somehow expected to have their own API key?