I’m looking at building a solution that allows for users to have an account with my website that is linked somehow to their corresponding stripe customer account. The way I am currently doing this is by using an external database server which holds customer account info such as email, password and stripe customer id. The stripe customer id is used to look up stored credit cards and billing info for the user. The problem I have with this current implementation is that the only reason why I am using an external database for this is to store a password securely (hashed of course) and this seems a little unnecessary.
Another thought I did have was to take advantage of the metadata property of the stripe customer object to store the hashed password. This way all customers live in stripe and that’s it. Is there any issues with doing it this way?
Sounds plausible. Did you try it out?
Related
I am updating my billing page which used Stripe JS V2 tokens and the Charges API (Subscriptions). The new(er) Payment Element looks slick from a future proofing standpoint, but am I understanding it correctly that the Customer object must be created prior to populating the payment form?
I only create the Customer once the payment token is obtained and a user has a clear intent to purchase after evaluating during a trial period. Otherwise my Stripe Dashboard is overrun with "empty" trial users that never sign up (I only have around a 10% signup rate from account creation). I guess this is mostly just a personal peeve, but I also just don't like to share user data and figured this way I would only be sharing with a third party once they become actual customers of mine.
Since a Subscription cannot be created without providing a Customer as part of the required parameters, am I stuck using the Card Element and the older Charges API if I don't create a Customer for every user in my system?
You really should just create a Customer up front. It will be required if you want to use trials with Subscriptions and will be cleaner in the long run.
For a workaround, which I would not overall recommend, you could use a SetupIntent with Payment Element to collect the customer's payment method without actually creating a Customer object. Then you can later create the Customer object and attach the PaymentMethod that was previously collected and then create the Subscription.
I'm looking into building an exercise logger on a pre-existing Shopify website. Ideally, I would like to link the user's customer profile with the exercise data being collected. Does Shopify allow you to do this and store the data on their servers somehow? Or would I have to store the data somewhere else like MongoDB? And would it even be possible to link the shopper account with an exercise logger?
A customer logged into a Shopify store has an ID. You can use that to store exercise data on your own server. Using the Shopify Admin API you can setup connections between the store and your database. Therefore you can indeed have code that would run, and allow you to Create, Read, Update or Delete any information you wanted, on a store.
Note however that due to a current weakness in Shopify App Proxy, it is possible (but unlikely) that a malicious actor could try impersonating a customer by trying random IDs till they got one that worked.
I have some stripe custom connect accounts that need updating.
We create these stripe connected accounts when a user signs up on our platform, but we don't ask for all of the information until later.
Here's the rub: We need a social security number. (We will be doing taxes later) I know that this goes into legal_entity, but the only way to update connected custom accounts is using the secret_key on the back end....but I can't let a SSN touch the back end!....Well, I guess that I could, but I didn't want ANY dangerous information to touch our server, EVER. I definitely wouldn't store it, but I worry about that making me liable.
So if I can't use the secret key in the browser, and I can't let the SSN touch the server....what is the correct way to update a connected account?
Using Stripe.js, you can generate Account Tokens that your server can reference when making API calls, just like you would get a card token when making payments.
There are directions on how to get the token and use it to update legal information in the documentation here:
https://stripe.com/docs/connect/account-tokens#updating
I want to know if it is safe to expose the charge ID e.g. ch_abc123. I want to know this so I have a way to issue refunds to a customer securely.
I was thinking of asking the customer for their details e.g. email, date of purchase but then I thought that there would not be a way to ensure the identity of the person requesting a refund.
Ideally, I would show the customer the charge ID so they can provide it when asking for a refund.
The charge ID itself is a unique ID that you can't do anything interesting with on its own, except by using your Stripe secret key, which you should protect.
But precisely because it is a simple unique ID that is not considered sensitive on its own, you should not rely it on as a form of authentication — the customer might share it or have it stolen. Or they could lose it and still want to get a refund.
I would suggest instead that you store the charge ID on your backend server along with any other order metadata that you have, and provide the option to request a refund only after the customer has authenticated to your system.
My requirement is, from my application I want my user to transfer the amount to another user of my application. Assume that both user have stripe account. I have gone through stripe docs, and I understood that in order to do transfer from one user account to another I need to use stripe connect. I could able to do authentication and I'm getting access token successfully for the sender. How can I make a transfer to a recipient ? I have only recipient's email id with me. Should I need to create a recipient through code and do the transfer using that recipient id returns from stripe ?
Im using php. Please help me.
Stripe Connect doesn't work like that. Instead, Connect allows an application to make card charges on behalf of a user and take a portion of the amount. The rest is automatically and immediately put into the user's Stripe account, where it's subject to the normal bank account transfer rules (2-7 day rolling transfers or API-driven manual transfers).
Another way to do this is using Stripe Recipients and Transfers. For example, your application charges a customer $10. You create a Recipient for your user using their bank account information (account number and routing number). Then, you can create a Transfer from your Stripe account to their bank account. Note that this only works for US bank accounts as of today.
If you really want to do user to user transfers, unfortunately Stripe isn't the platform for you. You could use PayPal or you could possibly use Balanced Payments, although again you can only transfer money to and from US bank accounts.