Stripe Payments & SaaS Billing Systems · Pelajaran

Menyimpan Metode Pembayaran dengan Aman (Token)

Pelajari praktik terbaik untuk mengumpulkan dan menyimpan detail metode pembayaran pelanggan dengan aman menggunakan tokenisasi Stripe.

Pelajaran 1 dari 411 langkah

Menyimpan Metode Pembayaran dengan Aman (Token) adalah pelajaran Stripe Payments & SaaS Billing Systems gratis di CoddyKit. Ini adalah pelajaran 1 dari 4. Kamu bisa membaca pelajaran lengkapnya di bawah secara gratis — lalu praktikkan langsung di browser dengan editor kode bawaan dan tutor AI 24/7. Ini adalah bagian dari jalur belajar Stripe Payments & SaaS Billing Systems, dan progresmu tersinkronisasi di web dan aplikasi CoddyKit. Kursus Stripe Payments & SaaS Billing Systems mencakup 4 pelajaran total.

Bagian dari pelajaran ini belum diterjemahkan dan ditampilkan dalam bahasa Inggris.

Payment Security Basics

Handling customer payment information is a huge responsibility! A data breach can severely damage your business's reputation and lead to significant financial penalties.

This lesson explores how to securely manage payment methods using Stripe's tokenization, protecting both your customers and your business.

The Peril of Raw Card Data

Storing raw credit card numbers, expiry dates, and CVVs directly on your servers is extremely risky. It makes you a prime target for hackers.

  • High Risk: Major security breaches.
  • PCI DSS: Requires strict compliance, which is complex and costly.
  • Liability: You're responsible for protecting this sensitive data.

Thankfully, Stripe offers a much safer alternative: tokenization.

Introducing Tokenization

Tokenization is the process of converting sensitive data into a non-sensitive string of characters, called a "token". Think of it as a secure placeholder.

When a customer enters their card details, Stripe intercepts them directly. Instead of sending the raw card data to your server, Stripe sends back a unique, single-use token.

Stripe's Tokenization Process

Here's how Stripe's tokenization works:

  1. Your customer enters card details into a form (powered by Stripe.js).
  2. Stripe.js sends these details directly to Stripe's secure servers.
  3. Stripe returns a unique, non-sensitive PaymentMethod ID to your client-side application.
  4. Your client-side application sends this PaymentMethod ID to your server.
  5. Your server then uses this ID to create charges or attach it to a customer, without ever touching raw card data.

Client-Side Token Creation

Stripe.js and Stripe Elements make client-side tokenization easy. You embed secure UI components that handle card input and send data directly to Stripe.

Here's a simplified look at how you might set up a card element and confirm a payment method on the client side:

<!-- index.html -->
<form id="payment-form">
  <div id="card-element"><!-- Stripe Elements will mount here --></div>
  <button id="submit-button">Save Card</button>
</form>

<script src="https://js.stripe.com/v3/"></script>
<script>
  const stripe = Stripe('pk_test_YOUR_PUBLISHABLE_KEY');
  const elements = stripe.elements();
  const cardElement = elements.create('card');
  cardElement.mount('#card-element');

  const form = document.getElementById('payment-form');
  form.addEventListener('submit', async (event) => {
    event.preventDefault();
    const { setupIntent, error } = await stripe.confirmCardSetup(
      '{{CLIENT_SECRET_FROM_SERVER}}', // This comes from your server
      {
        payment_method: {
          card: cardElement,
        },
      }
    );

    if (error) {
      console.error(error.message);
    } else {
      // payment_method.id can now be sent to your server
      console.log('PaymentMethod ID:', setupIntent.payment_method);
    }
  });
</script>

Attaching to Customer

Once you have the PaymentMethod ID from the client, you send it to your server. The server then attaches this PaymentMethod to a Stripe Customer object.

This is crucial for recurring payments or allowing customers to save cards for future use. The Customer object acts as a secure vault for their payment details.

Try running this Python example:

import stripe

stripe.api_key = "sk_test_YOUR_SECRET_KEY"

def attach_payment_method_to_customer(customer_id, payment_method_id):
    try:
        # Retrieve the customer
        customer = stripe.Customer.retrieve(customer_id)

        # Attach the PaymentMethod to the customer
        stripe.PaymentMethod.attach(
            payment_method_id,
            customer=customer.id,
        )
        print(f"PaymentMethod {payment_method_id} attached to customer {customer.id}")

        # You can also set it as the default payment method for invoices
        stripe.Customer.modify(
            customer.id,
            invoice_settings={
                "default_payment_method": payment_method_id,
            },
        )
        print(f"Set {payment_method_id} as default for customer {customer.id}")
        return True
    except stripe.error.StripeError as e:
        print(f"Error attaching PaymentMethod: {e}")
        return False

# --- Example Usage ---
if __name__ == "__main__":
    # In a real app, you'd get customer_id and payment_method_id from your frontend/database.
    # For demonstration, let's create a dummy customer and use a test PaymentMethod.
    # Replace 'pm_card_visa' with a real test PaymentMethod ID or one from your frontend.
    
    # 1. Create a new Customer (if one doesn't exist)
    try:
        new_customer = stripe.Customer.create(
            email="customer@example.com",
            description="Test Customer for Stored Cards"
        )
        test_customer_id = new_customer.id
        print(f"Created new customer: {test_customer_id}")
    except stripe.error.StripeError as e:
        print(f"Error creating customer: {e}")
        # If customer already exists with this email, retrieve it or handle error
        test_customer_id = "cus_NlQoY8Xf8Xf8Xf" # Replace with an existing customer ID for testing

    # 2. Use a test PaymentMethod ID (e.g., from Stripe's test card details)
    # This ID would typically come from your client-side via a SetupIntent.
    test_payment_method_id = "pm_card_visa" # A common test PM ID

    if test_customer_id:
        success = attach_payment_method_to_customer(test_customer_id, test_payment_method_id)
        if success:
            print("Successfully demonstrated attaching PaymentMethod.")
        else:
            print("Failed to attach PaymentMethod.")

Customer Objects: Secure Vault

Stripe's Customer object is more than just a customer record; it's a secure container for all their payment methods, subscriptions, and billing history.

  • PCI Compliance: Stripe handles the complex PCI DSS requirements for storing card data.
  • Reusability: Easily charge customers later without asking for card details again.
  • Multi-Payment: Store multiple cards for a single customer.

Always associate payment methods with a Customer object for secure, long-term storage.

Charging Stored Methods

Once a PaymentMethod is attached to a Customer, you can create charges against it whenever needed, without the customer re-entering their details.

This is essential for subscriptions, one-click purchases, or invoicing. You simply reference the Customer ID and the desired PaymentMethod ID.

Try running this example to charge a stored card:

import stripe

stripe.api_key = "sk_test_YOUR_SECRET_KEY"

def charge_stored_payment_method(customer_id, payment_method_id, amount, currency="usd"):
    try:
        # Create a PaymentIntent
        payment_intent = stripe.PaymentIntent.create(
            amount=amount,
            currency=currency,
            customer=customer_id,
            payment_method=payment_method_id,
            off_session=True, # Required for charging off-session
            confirm=True, # Confirm the payment immediately
        )

        if payment_intent.status == 'succeeded':
            print(f"Successfully charged {amount} {currency} using stored PaymentMethod {payment_method_id} for customer {customer_id}.")
            print(f"Payment Intent ID: {payment_intent.id}")
            return True
        else:
            print(f"PaymentIntent status: {payment_intent.status}")
            return False
    except stripe.error.StripeError as e:
        print(f"Error charging stored PaymentMethod: {e}")
        return False

# --- Example Usage ---
if __name__ == "__main__":
    # Replace with your actual customer and payment method IDs for testing
    # These would typically come from your database after a card has been saved.
    
    # Let's assume we have a customer and a default payment method from the previous step
    # For a real scenario, you'd fetch these from your own database.
    test_customer_id = "cus_NlQoY8Xf8Xf8Xf" # Replace with a valid customer ID
    test_payment_method_id = "pm_card_visa" # Replace with a valid PaymentMethod ID attached to the customer

    if test_customer_id and test_payment_method_id:
        charge_amount = 1000 # $10.00
        success = charge_stored_payment_method(
            test_customer_id,
            test_payment_method_id,
            charge_amount,
            "usd"
        )
        if success:
            print("Demonstrated charging a stored PaymentMethod.")
        else:
            print("Failed to charge stored PaymentMethod.")

PCI Compliance & Best Practices

By using Stripe's tokenization and Customer objects, you significantly reduce your PCI DSS (Payment Card Industry Data Security Standard) compliance burden.

  • Never Store Raw Data: Your servers should never see or store full card numbers.
  • Use Stripe Elements: Leverage Stripe's pre-built UI components for client-side data capture.
  • Secure API Keys: Protect your secret API keys; never expose them client-side.
  • HTTPS Everywhere: Ensure all communication is encrypted with HTTPS.

Quick Check: Token Security

Test your understanding of securely storing payment methods.

Recap: Secure Payments

In this lesson, we explored the critical importance of securely handling payment information. You learned about:

  • The risks of storing raw card data.
  • How tokenization with Stripe protects sensitive information.
  • Using Stripe.js to capture payment details client-side.
  • Attaching PaymentMethod objects to Customer objects for secure, reusable storage.
  • Best practices for maintaining PCI compliance.

You're now equipped to build more secure payment flows!

Gratis untuk memulai

Belajar Stripe Payments & SaaS Billing Systems dengan tutor AI — gratis

Tulis dan jalankan kode asli di browser kamu, dapatkan bantuan instan dari tutor AI 24/7, dan lanjutkan di mana kamu tinggalkan di web atau aplikasi.

Kursus
12
Pelajaran
48

Pertanyaan yang Sering Diajukan

Apakah pelajaran “Menyimpan Metode Pembayaran dengan Aman (Token)” gratis?

Ya — teks lengkap “Menyimpan Metode Pembayaran dengan Aman (Token)” gratis dibaca di sini di web. Untuk praktiknya secara interaktif (editor kode bawaan dan tutor AI 24/7) dan buka sisa kursus Stripe Payments & SaaS Billing Systems, upgrade ke CoddyKit PRO. Kursus Stripe Payments & SaaS Billing Systems mencakup 4 pelajaran total.

Apa yang akan aku pelajari di “Menyimpan Metode Pembayaran dengan Aman (Token)”?

Pelajari praktik terbaik untuk mengumpulkan dan menyimpan detail metode pembayaran pelanggan dengan aman menggunakan tokenisasi Stripe. Kamu berlatih Stripe Payments & SaaS Billing Systems dengan kode praktik yang langsung kamu jalankan di browser, dan tutor AI 24/7 menjawab pertanyaanmu saat kamu mengerjakan pelajaran ini.

Apakah aku perlu pengalaman untuk memulai Stripe Payments & SaaS Billing Systems?

Tidak diperlukan pengalaman sebelumnya. Stripe Payments & SaaS Billing Systems di CoddyKit dirancang untuk pemula hingga pelajar tingkat lanjut, jadi kamu bisa memulai di sini atau dari awal dan belajar sesuai kecepatan kamu sendiri. Ini adalah pelajaran 1 dari 4.

Berapa lama pelajaran “Menyimpan Metode Pembayaran dengan Aman (Token)” memakan waktu?

Sebagian besar pelajaran CoddyKit memakan waktu sekitar 5–10 menit. Setiap pelajaran ringkas dan interaktif, jadi kamu membuat kemajuan stabil dan melanjutkan dari tempat kamu tinggalkan di web dan aplikasi.

Bisakah aku menulis dan menjalankan kode dalam pelajaran Stripe Payments & SaaS Billing Systems ini?

Ya. Setiap pelajaran Stripe Payments & SaaS Billing Systems menyertakan editor kode bawaan, jadi kamu menulis dan menjalankan kode nyata langsung di browser dan mendapatkan umpan balik AI instan — tidak diperlukan penyiapan lokal.

Semua pelajaran dalam kursus ini

  1. Menyimpan Metode Pembayaran dengan Aman (Token)
  2. Menerapkan Strong Customer Authentication (SCA)
  3. Praktik Terbaik Kepatuhan PCI bagi Pengembang
  4. Memverifikasi Tanda Tangan Webhook dengan Aman
← Kembali ke Stripe Payments & SaaS Billing Systems