Stripe Payments & SaaS Billing Systems · Ders

Ödeme Yöntemlerini Güvenle Saklama (Token'lar)

Stripe'ın tokenleştirmesini kullanarak müşteri ödeme yöntemi bilgilerini güvenli şekilde toplama ve saklamaya ilişkin en iyi uygulamaları öğrenin.

1. ders / 411 adım

Ödeme Yöntemlerini Güvenle Saklama (Token'lar), CoddyKit'te ücretsiz bir Stripe Payments & SaaS Billing Systems dersidir. Bu, 4 dersinin 1. dersidir. Aşağıdan dersin tamamını ücretsiz okuyabilir, sonra tarayıcıda yerleşik kod editörü ve 7/24 yapay zeka koçu ile uygulamalı olarak pratik yapabilirsin. Bu, Stripe Payments & SaaS Billing Systems öğrenme yolunun bir parçasıdır ve ilerlemeniz web ve CoddyKit uygulaması arasında senkronize olur. Stripe Payments & SaaS Billing Systems kursu toplamda 4 dersten oluşur.

Bu dersin bazı bölümleri henüz çevrilmemiş olup İngilizce olarak gösterilmektedir.

Payment Security Basics

Handling customer payment information is a huge responsibility! A data breach can severely damage your business's reputation and lead to significant financial penalties.

This lesson explores how to securely manage payment methods using Stripe's tokenization, protecting both your customers and your business.

The Peril of Raw Card Data

Storing raw credit card numbers, expiry dates, and CVVs directly on your servers is extremely risky. It makes you a prime target for hackers.

  • High Risk: Major security breaches.
  • PCI DSS: Requires strict compliance, which is complex and costly.
  • Liability: You're responsible for protecting this sensitive data.

Thankfully, Stripe offers a much safer alternative: tokenization.

Introducing Tokenization

Tokenization is the process of converting sensitive data into a non-sensitive string of characters, called a "token". Think of it as a secure placeholder.

When a customer enters their card details, Stripe intercepts them directly. Instead of sending the raw card data to your server, Stripe sends back a unique, single-use token.

Stripe's Tokenization Process

Here's how Stripe's tokenization works:

  1. Your customer enters card details into a form (powered by Stripe.js).
  2. Stripe.js sends these details directly to Stripe's secure servers.
  3. Stripe returns a unique, non-sensitive PaymentMethod ID to your client-side application.
  4. Your client-side application sends this PaymentMethod ID to your server.
  5. Your server then uses this ID to create charges or attach it to a customer, without ever touching raw card data.

Client-Side Token Creation

Stripe.js and Stripe Elements make client-side tokenization easy. You embed secure UI components that handle card input and send data directly to Stripe.

Here's a simplified look at how you might set up a card element and confirm a payment method on the client side:

<!-- index.html -->
<form id="payment-form">
  <div id="card-element"><!-- Stripe Elements will mount here --></div>
  <button id="submit-button">Save Card</button>
</form>

<script src="https://js.stripe.com/v3/"></script>
<script>
  const stripe = Stripe('pk_test_YOUR_PUBLISHABLE_KEY');
  const elements = stripe.elements();
  const cardElement = elements.create('card');
  cardElement.mount('#card-element');

  const form = document.getElementById('payment-form');
  form.addEventListener('submit', async (event) => {
    event.preventDefault();
    const { setupIntent, error } = await stripe.confirmCardSetup(
      '{{CLIENT_SECRET_FROM_SERVER}}', // This comes from your server
      {
        payment_method: {
          card: cardElement,
        },
      }
    );

    if (error) {
      console.error(error.message);
    } else {
      // payment_method.id can now be sent to your server
      console.log('PaymentMethod ID:', setupIntent.payment_method);
    }
  });
</script>

Attaching to Customer

Once you have the PaymentMethod ID from the client, you send it to your server. The server then attaches this PaymentMethod to a Stripe Customer object.

This is crucial for recurring payments or allowing customers to save cards for future use. The Customer object acts as a secure vault for their payment details.

Try running this Python example:

import stripe

stripe.api_key = "sk_test_YOUR_SECRET_KEY"

def attach_payment_method_to_customer(customer_id, payment_method_id):
    try:
        # Retrieve the customer
        customer = stripe.Customer.retrieve(customer_id)

        # Attach the PaymentMethod to the customer
        stripe.PaymentMethod.attach(
            payment_method_id,
            customer=customer.id,
        )
        print(f"PaymentMethod {payment_method_id} attached to customer {customer.id}")

        # You can also set it as the default payment method for invoices
        stripe.Customer.modify(
            customer.id,
            invoice_settings={
                "default_payment_method": payment_method_id,
            },
        )
        print(f"Set {payment_method_id} as default for customer {customer.id}")
        return True
    except stripe.error.StripeError as e:
        print(f"Error attaching PaymentMethod: {e}")
        return False

# --- Example Usage ---
if __name__ == "__main__":
    # In a real app, you'd get customer_id and payment_method_id from your frontend/database.
    # For demonstration, let's create a dummy customer and use a test PaymentMethod.
    # Replace 'pm_card_visa' with a real test PaymentMethod ID or one from your frontend.
    
    # 1. Create a new Customer (if one doesn't exist)
    try:
        new_customer = stripe.Customer.create(
            email="customer@example.com",
            description="Test Customer for Stored Cards"
        )
        test_customer_id = new_customer.id
        print(f"Created new customer: {test_customer_id}")
    except stripe.error.StripeError as e:
        print(f"Error creating customer: {e}")
        # If customer already exists with this email, retrieve it or handle error
        test_customer_id = "cus_NlQoY8Xf8Xf8Xf" # Replace with an existing customer ID for testing

    # 2. Use a test PaymentMethod ID (e.g., from Stripe's test card details)
    # This ID would typically come from your client-side via a SetupIntent.
    test_payment_method_id = "pm_card_visa" # A common test PM ID

    if test_customer_id:
        success = attach_payment_method_to_customer(test_customer_id, test_payment_method_id)
        if success:
            print("Successfully demonstrated attaching PaymentMethod.")
        else:
            print("Failed to attach PaymentMethod.")

Customer Objects: Secure Vault

Stripe's Customer object is more than just a customer record; it's a secure container for all their payment methods, subscriptions, and billing history.

  • PCI Compliance: Stripe handles the complex PCI DSS requirements for storing card data.
  • Reusability: Easily charge customers later without asking for card details again.
  • Multi-Payment: Store multiple cards for a single customer.

Always associate payment methods with a Customer object for secure, long-term storage.

Charging Stored Methods

Once a PaymentMethod is attached to a Customer, you can create charges against it whenever needed, without the customer re-entering their details.

This is essential for subscriptions, one-click purchases, or invoicing. You simply reference the Customer ID and the desired PaymentMethod ID.

Try running this example to charge a stored card:

import stripe

stripe.api_key = "sk_test_YOUR_SECRET_KEY"

def charge_stored_payment_method(customer_id, payment_method_id, amount, currency="usd"):
    try:
        # Create a PaymentIntent
        payment_intent = stripe.PaymentIntent.create(
            amount=amount,
            currency=currency,
            customer=customer_id,
            payment_method=payment_method_id,
            off_session=True, # Required for charging off-session
            confirm=True, # Confirm the payment immediately
        )

        if payment_intent.status == 'succeeded':
            print(f"Successfully charged {amount} {currency} using stored PaymentMethod {payment_method_id} for customer {customer_id}.")
            print(f"Payment Intent ID: {payment_intent.id}")
            return True
        else:
            print(f"PaymentIntent status: {payment_intent.status}")
            return False
    except stripe.error.StripeError as e:
        print(f"Error charging stored PaymentMethod: {e}")
        return False

# --- Example Usage ---
if __name__ == "__main__":
    # Replace with your actual customer and payment method IDs for testing
    # These would typically come from your database after a card has been saved.
    
    # Let's assume we have a customer and a default payment method from the previous step
    # For a real scenario, you'd fetch these from your own database.
    test_customer_id = "cus_NlQoY8Xf8Xf8Xf" # Replace with a valid customer ID
    test_payment_method_id = "pm_card_visa" # Replace with a valid PaymentMethod ID attached to the customer

    if test_customer_id and test_payment_method_id:
        charge_amount = 1000 # $10.00
        success = charge_stored_payment_method(
            test_customer_id,
            test_payment_method_id,
            charge_amount,
            "usd"
        )
        if success:
            print("Demonstrated charging a stored PaymentMethod.")
        else:
            print("Failed to charge stored PaymentMethod.")

PCI Compliance & Best Practices

By using Stripe's tokenization and Customer objects, you significantly reduce your PCI DSS (Payment Card Industry Data Security Standard) compliance burden.

  • Never Store Raw Data: Your servers should never see or store full card numbers.
  • Use Stripe Elements: Leverage Stripe's pre-built UI components for client-side data capture.
  • Secure API Keys: Protect your secret API keys; never expose them client-side.
  • HTTPS Everywhere: Ensure all communication is encrypted with HTTPS.

Quick Check: Token Security

Test your understanding of securely storing payment methods.

Recap: Secure Payments

In this lesson, we explored the critical importance of securely handling payment information. You learned about:

  • The risks of storing raw card data.
  • How tokenization with Stripe protects sensitive information.
  • Using Stripe.js to capture payment details client-side.
  • Attaching PaymentMethod objects to Customer objects for secure, reusable storage.
  • Best practices for maintaining PCI compliance.

You're now equipped to build more secure payment flows!

Başlamak ücretsiz

Yapay zeka eğitmeniyle Stripe Payments & SaaS Billing Systems öğren — ücretsiz

Tarayıcında gerçek kod yaz ve çalıştır, 7/24 yapay zeka eğitmeninden anında yardım al; web'de ya da uygulamada kaldığın yerden devam et.

Kurslar
12
Dersler
48

Sıkça Sorulan Sorular

“Ödeme Yöntemlerini Güvenle Saklama (Token'lar)” dersi ücretsiz mi?

Evet — “Ödeme Yöntemlerini Güvenle Saklama (Token'lar)” dersin tüm metni burada web'de ücretsiz olarak okunabilir. Etkileşimli olarak pratik yapmak (yerleşik kod editörü ve 7/24 yapay zeka koçu) ve Stripe Payments & SaaS Billing Systems kursunun geri kalanını açmak için CoddyKit PRO'ya yükselt. Stripe Payments & SaaS Billing Systems kursu toplamda 4 dersten oluşur.

“Ödeme Yöntemlerini Güvenle Saklama (Token'lar)” dersinde ne öğreneceğim?

Stripe'ın tokenleştirmesini kullanarak müşteri ödeme yöntemi bilgilerini güvenli şekilde toplama ve saklamaya ilişkin en iyi uygulamaları öğrenin. Stripe Payments & SaaS Billing Systems ile uygulamalı kodu tarayıcıda doğrudan çalıştırarak pratik yaparsın ve 7/24 yapay zeka koçu dersi çalışırken sorularını yanıtlar.

Stripe Payments & SaaS Billing Systems öğrenmeye başlamak için deneyim gerekli mi?

Önceden deneyim gerekmez. CoddyKit'te Stripe Payments & SaaS Billing Systems, başlangıçtan ileri seviyeye kadar yapılandırıldığı için buradan başlayabilir veya başından başlayıp kendi hızında ilerleme yapabilirsin. Bu, 4 dersinin 1. dersidir.

“Ödeme Yöntemlerini Güvenle Saklama (Token'lar)” dersi ne kadar sürer?

Çoğu CoddyKit dersi yaklaşık 5–10 dakika sürer. Her biri kısa ve etkileşimli olduğu için sabit ilerleme yaparsın ve web ile uygulama arasında tam olarak bıraktığın yerden devam edebilirsin.

Bu Stripe Payments & SaaS Billing Systems dersinde kod yazıp çalıştırabilir miyim?

Evet. Her Stripe Payments & SaaS Billing Systems dersi yerleşik bir kod editörü içerir, bu sayede tarayıcıda gerçek kod yazıp çalıştırabilir ve anlık yapay zeka geri bildirimi alırsın — yerel kurulum gerekli değildir.

Bu kursun tüm dersleri

  1. Ödeme Yöntemlerini Güvenle Saklama (Token'lar)
  2. Güçlü Müşteri Kimlik Doğrulamasını (SCA) Uygulama
  3. Geliştiriciler için PCI Uyumluluğu En İyi Uygulamaları
  4. Webhook İmzalarını Güvenli Biçimde Doğrulama
← Stripe Payments & SaaS Billing Systems Sayfasına Dön