#george.segovia

1 messages · Page 1 of 1 (latest)

rugged sigilBOT
ancient pumice
#

Are you also updating your backend to use PaymentIntents API?

wind thicket
#

Yes, I should have mentioned it as well 🙂

ancient pumice
#

OK, Stripe.js v2 create sources object, and you can still use sources with PaymentIntents API

wind thicket
#

Are you talking about the Sources API that has been marked as deprecated?

I am asking, since the whole effort to update to V3 is not use any deprecated APIs at all 🙂

ancient pumice
#

Yes

#

Then you should use v3 instead of v2.

wind thicket
#

Ideally, we would like to keep using the previous UI we already had built to collect the user's payment info.

However, I see that using a custom form to collect payment data, is not recommended: https://stripe.com/docs/security/guide#validating-pci-compliance

Can you confirm this ☝️ ?

ps. Trying to understand the effort needed and what would be the impact to our current UX flow

Integration security guide

Ensure PCI compliance and secure customer-server communications.

ancient pumice
#

OK, if you want to use your own UI to collect senstive card information, you need to fulfil SAQ D requirement. This is the most difficult PCI compliance and I'd strongly suggest you to check with your compliance team whether it's worthy to go for this integration path.

wind thicket
#
  1. Otherwise we should use StripeElements?
  2. Or even the individual fields exposed from Elements? i.e. stripe.elements.create('cardNumber') / `stripe.elements.create('cardExpiry')