Clash Royale CLAN TAG#URR8PPP

Stripe card handling

I'm hoping someone here could throw their eye over my flow, to see if I'm doing things correctly and, if not, to advise me as to where to improve.

My scenario is a simple one:

Step 1

At this point I have, I believe, a response id and a source object containing the abstracted card details as well as a card id.

Step 2

I connect to the Stripe API:

Stripe::setApiKey($stripe_secret_key); // note this is a Connect account
Stripe::setApiVersion('2018-05-21');


I check to see if I already have a Stripe customer id stored for this email address. If so, I use that. Otherwise, I create a Stripe customer:

$customer = Stripe_Customer::create(
[
'description' => $u->user_email,
'email'=>$u->user_email
], $stripe_access_token
);
$customer_id = $customer->id;


I then fetch that customer's Stripe object:

$customer = Stripe_Customer::retrieve($customer_id);


and then I fetch the source object, using the response id

$source = Stripe_Token::retrieve($form_response_id);


Step 3

I want to make sure that the fee is taken from the card the Customer is using right now, irrespective of whether or not they have visited before or not, or used the same card before or not. So I save this source to the customer:

$customer->sources->create(['source' => $source->id]);
$customer->save();


... and, although the latest source is supposed to be the default source (i.e. the one that's used), I make sure of it:

$customer->default_source = $source->card->id;
$customer->save();


Step 4

I do some local work to get fee descriptions, calculate application fees, etc. I put this altogether as a charge array, using the inititial card id I received from Stripe.js as the 'source' parameter

$charge = [
'customer' => $customer->id,
'source' => $transaction_card_id,
'amount' => $total_gross_received_cents,
'currency' => 'EUR',
'description' => $transaction_desc,
'application_fee' => $application_fee
];

$charge_obj = Stripe_Charge::create($charge, $stripe_access_token);
$charge_id = $charge_obj->id;


I then save the $charge_id in my transaction records.

$charge_id

Questions

My biggest concerns revolve around Step 3 - making sure that the right card is accepted and used. Note that:

Can I save the card as a new source for the customer every time, even if it already exists and is assigned to them? It seems to be working, and overwriting duplicate source records, but I want to be sure.

Obviously, I'm nervous about rolling out something I feel I don't fully grok yet, so if someone could give me a thumbs up or thumbs down, I be very grateful.

1 Answer
1

Here are my notes:

The card information needs to be stored safely on the side of trusted payments gateways (e.g: Stripe, PayPal). Not storing the sensitive credit card information is one of the PCI compliance requirements.

In your case, I think you can use the token. Or creating a customer and saving your customer ID for later use.

https://stripe.com/docs/saving-cards
https://stripe.com/docs/recipes/updating-customer-cards
https://stackoverflow.com/a/18377973/5179786

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.