Securely Storing Payment Methods (Tokens)

Payment Security Basics

The Peril of Raw Card Data

Introducing Tokenization

Stripe's Tokenization Process

Client-Side Token Creation

<!-- index.html -->
<form id="payment-form">
  <div id="card-element"><!-- Stripe Elements will mount here --></div>
  <button id="submit-button">Save Card</button>
</form>

<script src="https://js.stripe.com/v3/"></script>
<script>
  const stripe = Stripe('pk_test_YOUR_PUBLISHABLE_KEY');
  const elements = stripe.elements();
  const cardElement = elements.create('card');
  cardElement.mount('#card-element');

  const form = document.getElementById('payment-form');
  form.addEventListener('submit', async (event) => {
    event.preventDefault();
    const { setupIntent, error } = await stripe.confirmCardSetup(
      '{{CLIENT_SECRET_FROM_SERVER}}', // This comes from your server
      {
        payment_method: {
          card: cardElement,
        },
      }
    );

    if (error) {
      console.error(error.message);
    } else {
      // payment_method.id can now be sent to your server
      console.log('PaymentMethod ID:', setupIntent.payment_method);
    }
  });
</script>

Attaching to Customer

import stripe

stripe.api_key = "sk_test_YOUR_SECRET_KEY"

def attach_payment_method_to_customer(customer_id, payment_method_id):
    try:
        # Retrieve the customer
        customer = stripe.Customer.retrieve(customer_id)

        # Attach the PaymentMethod to the customer
        stripe.PaymentMethod.attach(
            payment_method_id,
            customer=customer.id,
        )
        print(f"PaymentMethod {payment_method_id} attached to customer {customer.id}")

        # You can also set it as the default payment method for invoices
        stripe.Customer.modify(
            customer.id,
            invoice_settings={
                "default_payment_method": payment_method_id,
            },
        )
        print(f"Set {payment_method_id} as default for customer {customer.id}")
        return True
    except stripe.error.StripeError as e:
        print(f"Error attaching PaymentMethod: {e}")
        return False

# --- Example Usage ---
if __name__ == "__main__":
    # In a real app, you'd get customer_id and payment_method_id from your frontend/database.
    # For demonstration, let's create a dummy customer and use a test PaymentMethod.
    # Replace 'pm_card_visa' with a real test PaymentMethod ID or one from your frontend.
    
    # 1. Create a new Customer (if one doesn't exist)
    try:
        new_customer = stripe.Customer.create(
            email="customer@example.com",
            description="Test Customer for Stored Cards"
        )
        test_customer_id = new_customer.id
        print(f"Created new customer: {test_customer_id}")
    except stripe.error.StripeError as e:
        print(f"Error creating customer: {e}")
        # If customer already exists with this email, retrieve it or handle error
        test_customer_id = "cus_NlQoY8Xf8Xf8Xf" # Replace with an existing customer ID for testing

    # 2. Use a test PaymentMethod ID (e.g., from Stripe's test card details)
    # This ID would typically come from your client-side via a SetupIntent.
    test_payment_method_id = "pm_card_visa" # A common test PM ID

    if test_customer_id:
        success = attach_payment_method_to_customer(test_customer_id, test_payment_method_id)
        if success:
            print("Successfully demonstrated attaching PaymentMethod.")
        else:
            print("Failed to attach PaymentMethod.")

Customer Objects: Secure Vault

Charging Stored Methods

import stripe

stripe.api_key = "sk_test_YOUR_SECRET_KEY"

def charge_stored_payment_method(customer_id, payment_method_id, amount, currency="usd"):
    try:
        # Create a PaymentIntent
        payment_intent = stripe.PaymentIntent.create(
            amount=amount,
            currency=currency,
            customer=customer_id,
            payment_method=payment_method_id,
            off_session=True, # Required for charging off-session
            confirm=True, # Confirm the payment immediately
        )

        if payment_intent.status == 'succeeded':
            print(f"Successfully charged {amount} {currency} using stored PaymentMethod {payment_method_id} for customer {customer_id}.")
            print(f"Payment Intent ID: {payment_intent.id}")
            return True
        else:
            print(f"PaymentIntent status: {payment_intent.status}")
            return False
    except stripe.error.StripeError as e:
        print(f"Error charging stored PaymentMethod: {e}")
        return False

# --- Example Usage ---
if __name__ == "__main__":
    # Replace with your actual customer and payment method IDs for testing
    # These would typically come from your database after a card has been saved.
    
    # Let's assume we have a customer and a default payment method from the previous step
    # For a real scenario, you'd fetch these from your own database.
    test_customer_id = "cus_NlQoY8Xf8Xf8Xf" # Replace with a valid customer ID
    test_payment_method_id = "pm_card_visa" # Replace with a valid PaymentMethod ID attached to the customer

    if test_customer_id and test_payment_method_id:
        charge_amount = 1000 # $10.00
        success = charge_stored_payment_method(
            test_customer_id,
            test_payment_method_id,
            charge_amount,
            "usd"
        )
        if success:
            print("Demonstrated charging a stored PaymentMethod.")
        else:
            print("Failed to charge stored PaymentMethod.")

PCI Compliance & Best Practices

Quick Check: Token Security

Recap: Secure Payments