Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Basic Stripe Payments

Basic Stripe Payments

Quick runthrough of how to use Stripe to accept credit cards while avoiding as much PCI compliance as possible with as little work as possible.

Bob Majdak Jr

October 02, 2018
Tweet

More Decks by Bob Majdak Jr

Other Decks in Programming

Transcript

  1. PCI Compliance Payment Card Industry Data Security Standard. "The PCI

    DSS applies to ANY organization, regardless of size or number of transactions, that accepts, transmits or stores any cardholder data." SAQ - Self Assessment Questions
  2. Stripe • A PCI DSS validated third-party service provider. •

    Decent set of APIs. • Pretty good set of libraries. • Nice documentation. • 2.9% + 30c: Visa, MasterCard, American Express, Discover, few more. • International Cards: +1% "Currency Conversion Fee" • ACH: 0.8% up to 5$ • Transfer to you: free. Automatic every 3 days.
  3. GOAL: PCI SAQ A • All payment acceptance and processing

    are entirely outsourced to PCI DSS validated third-party service providers. • Merchant has no direct control of the manner in which cardholder data is captured, processed, transmitted, or stored. • Merchant does not electronically store, process, or transmit any cardholder data on merchant systems.
  4. Processing Workflow User has money. Submits Order. Stripe collects CC,

    personal info. Stripe returns preauth token. Try Again. User has less money. Present receipt. ... Commit charge for real.
  5. Money Bad Idea /api/cart { Subtotal: 16.24, Items: [ ...

    ] } { amount: parseInt(Result.Subtotal * 100) } Expected: 1624 Result: 1623.99999999997 Result Result: $16.23
  6. Apple Pay, Google Pay, Microsoft Pay Payment Request Button User

    wants to buy. User provides CC details. Confirm Checkout Token User hast buyed. User provides CC details but via the ApplePay or w/e acting as an invisible proxy more or less.