supercodepoet-payment-request | Stripe Developers | Page 1

keen drift Sep 23, 2021, 1:51 PM

#

small phoenix Sep 23, 2021, 1:53 PM

#

Just to clarify, you're referring to the stripe.paymentRequest method in our JS library?

tropic pond Sep 23, 2021, 1:56 PM

#

yes, from the very beginning we have used Stripe.js and Stripe Elements to gather credit card information from the user and receive a payment token from Stripe

#

we then pass that payment token to our backend and use the Stripe API to create a customer with that payment token as the source

#

and then create a subscription with that customer that then charges with card and activates the subscription

#

we do not support async subscription creation at this time some fail subscriptions with incomplete status

#

this has worked for years and even up to three days ago

#

when we started seeing errors in our testing with the 4242 4242 4242 4242 test number and the 'tok_visa' test token

#

and it has now fully migrated to production where it is failing all new charges with payment intent issues

small phoenix Sep 23, 2021, 2:00 PM

#

Thanks for that info! No, the paymentRequest function hasn't been deprecated. Do you have any IDs associated with the testing you did that we can take a closer look at? Such as the subscription ID or payment intent ID?

tropic pond Sep 23, 2021, 2:07 PM

#

here is a testing payment ID: pi_3JcdnTG6SOg4bQjg1rrr0ouD

small phoenix Sep 23, 2021, 2:12 PM

#

Thank you for that!

subtle peak Sep 23, 2021, 2:14 PM

#

(I work with supercodepoet. We haven't been able to receive any Stripe payments since at least yesterday.)

#

(And our volume is about 1/5 to 1/10 on Stripe what it usually is.)

tropic pond Sep 23, 2021, 2:16 PM

#

renewals are going through but new sign-ups are not

small phoenix Sep 23, 2021, 2:18 PM

#

Gotcha, I am seeing a lot of calls to our tokens endpoint that are failing. Please bear with me while I dig into those a bit deeper.

#

Based on what I'm seeing, we're returning the following error for those calls:
{ error: { code: "invalid_number", doc_url: "https://stripe.com/docs/error-codes/invalid-number", message: "The 'exp_month' parameter should be an integer (instead, is <mes>).", param: "exp_month", type: "card_error" } }

#

It looks like we're being sent odd values for number, exp_month, and exp_year parameters within the card object.

    exp_month: "<mes>",
    exp_year: "<ano>"```

tropic pond Sep 23, 2021, 2:25 PM

#

where are you seeing those errors?

#

we use Stripe Elements to collect the card information

keen drift Sep 23, 2021, 2:25 PM

#

Can you share your elements snippet?

#

And can we access this on your page?

tropic pond Sep 23, 2021, 2:27 PM

#

@keen drift message you the URL to look at

keen drift Sep 23, 2021, 2:37 PM

#

When I try to subscribe with the 4242 card I hit this:

errors: [{,…}]
0: {,…}
detail: "Payment for this subscription requires additional user action before it can be completed successfully. Payment can be completed using the PaymentIntent associated with subscription.latest_invoice. Additional information is available here: https://stripe.com/docs/billing/subscriptions/overview#requires-action"
jsonapi: {version: "1.0"}

How subscriptions work

Learn how subscriptions work within Stripe.

#

YOu're seemingly passing through an error about 3ds authentication

tropic pond Sep 23, 2021, 2:39 PM

#

that is what we thought as well

#

but this is happening on ALL cards

#

even non-3DS cards

#

and according to Stripe documentation 4242 4242 4242 4242 should not fire 3DS errors

#

@keen drift messaged you a production payment ID is that as same error for a non-3DS card

keen drift Sep 23, 2021, 2:44 PM

#

Looking at your logs there are a lot of requests for creating tokens that look like this: https://dashboard.stripe.com/logs/req_TDTwouL0RDwHTr

#

Is that coming from you?

tropic pond Sep 23, 2021, 2:49 PM

#

we just call createToken() with the card element created by Stripe Elements

#

we were having issues with some card testing hacking over the last couple days that we refined our API to shutdown

#

I wonder if that is from the card testing stuff

keen drift Sep 23, 2021, 2:50 PM

#

yea that could be the case

tropic pond Sep 23, 2021, 2:50 PM

#

could card testing put us in some kind of limbo or lock on our account

keen drift Sep 23, 2021, 2:53 PM

#

Not without us telling you, i wouldnt expect

tropic pond Sep 23, 2021, 2:55 PM

#

I can try an place another order with a non-3DS card on production and give you the payment ID afterward if that will help. I should fail with the same payment intent errors

#

let me know if you would like me to try

keen drift Sep 23, 2021, 3:03 PM

#

We're looking at it

#

Trying to dig into why that example payment for a new sub failed, thanks for sending that

tropic pond Sep 23, 2021, 3:05 PM

#

PMed you an actual production payment ID that failed as well

keen drift Sep 23, 2021, 3:05 PM

#

yea already had that thanks

keen drift Sep 23, 2021, 3:27 PM

#

hey i was just able to succeed the signup on your test page

#

can you confirm that yourself too?

#

Does the timing of this align with the changes you made related to card testing?

#

Ok i'm still getting the error when trying again, so must have been an intermittent success

tropic pond Sep 23, 2021, 3:38 PM

#

ahhh, ok

#

this one went through pi_3JctorG6SOg4bQjg12M670eH

#

for test@example.com

keen drift Sep 23, 2021, 3:39 PM

#

yea that one

#

we're still digging

tropic pond Sep 23, 2021, 3:39 PM

#

ok

#

our automated tests fail in our backend using 'tok_visa" or 'tok_amex_threeDSecureNotSupported' as well

keen drift Sep 23, 2021, 4:06 PM

#

Alright so after working through this it's seemingly related to the card testing mitigations and your use of error_if_incomplete -- this is getting in the way of some client side actions.

I'd encourage you to continue working with support regarding the card testing, but you do have some options to unblock yourself.

First, you should make sure your customer create endpoint is captcha-protected so that the card testers can't hit that with the tokens

#

Second, you're going to want to handle those incomplete subscriptions, and the easiest way to do this which should also help with the card testing is to use default_incomplete and perform the confirmation client-side afterwards. It's flipping your integration around.

#

Right now you do:
1/ create a token
2/ create a customer with that token
3/ create a sub for that customer

Instead, you'd do:
1/ Create the customer
2/ Create the sub with default_incomplete,
3/ Return the payment intent client secret to the client
4/ Confirm that payment intent client-side with elements

tropic pond Sep 23, 2021, 4:11 PM

#

yep, I saw that with https://stripe.com/docs/billing/subscriptions/elements

Create subscriptions with Elements

Learn how to offer multiple pricing options to your customers and charge them a fixed amount each month.

keen drift Sep 23, 2021, 4:11 PM

#

There's another option of using allow_incomplete that would be a smaller shift, but it requires handling more logic paths: https://stripe.com/docs/billing/migration/strong-customer-authentication#scenario-1

keen drift Sep 23, 2021, 4:11 PM

#

tropic pond yep, I saw that with https://stripe.com/docs/billing/subscriptions/elements

yes, exactly this

tropic pond Sep 23, 2021, 4:12 PM

#

it seems like the default path for integration with Elements changed at some point cause the first path is the what we did following the integration with Elements originally

#

so is the path we are using just broken somehow or deprecated?

keen drift Sep 23, 2021, 4:15 PM

#

it is deprecated, yes, and what you see now is what we added to reduce the number of logic branches to handle (eg, always confirm client side, don't need to check for actions required)

subtle peak Sep 23, 2021, 4:19 PM

#

Do did you all deprecate what we were using on Monday? Is that why this is failing now?

keen drift Sep 23, 2021, 4:20 PM

#

No its still a valid integration, as i said these errors are related to the card testing mitigations you're working with support on

#

So given that, my suggestion is to consider moving to the newer pattern which will help

subtle peak Sep 23, 2021, 4:22 PM

#

Understood.

#

What I'm trying to understand now is why things broke.

#

If it was on our end, that's obviously on us. If it was on your end, that's something else to understand.

tropic pond Sep 23, 2021, 4:25 PM

#

ok, so we prototyped the new way and figured out where this is breaking on our account

#

basically the payemtn intent requires_action

#

because elements wants to fire a captcha

#

and we don;t handle that

#

we jsut listen for the token to be generated

#

so the Stripe.js was changed or our accoutn was changed to require catpcha (I'm am a human) model to fire on all card submittions

keen drift Sep 23, 2021, 4:26 PM

#

That's roughly correct - those captchas are the actions you need to handle

#

which isn't going to work with your error_if_incomplete approach

tropic pond Sep 23, 2021, 4:27 PM

#

but doesn't that then break the official path we are using

#

@elder sage is going to create a video of this prototype

#

is there no way not to fire the captcha? we have our own Google Captcha firing before creation of subscription

keen drift Sep 23, 2021, 4:37 PM

#

if you're doing mitigation separately, then you'll need to work with support to adjust the settings on your account

#

You can handle it, yes, but you'll need to not use error on incomplete to accomplish that

subtle peak Sep 23, 2021, 4:37 PM

#

What's the reason these settings were applied to our account without us being alerted?

keen drift Sep 23, 2021, 4:39 PM

#

I can't speak to that here -- you'll need to work with support, continuing the discussion about card testing

subtle peak Sep 23, 2021, 4:49 PM

#

Okay, well let's be clear what happened when our account was changed and we were not alerted: we can no longer receive payments.

#

This is a serious risk to our business that you all can behave this way.

elder sage Sep 23, 2021, 4:55 PM

#

ok, I was in the middle of recording a demonstration of that CAPTCHA popping up

#

and it no longer is doing it 😕

keen drift Sep 23, 2021, 4:56 PM

#

I understand -- and we're still investigating whether something went wrong here

#

As I said I would encourage you to work with the person who was helping you with card testing

#

and here, now, i can help you with alternatives to unblock yourself

elder sage Sep 23, 2021, 4:59 PM

#

thank you @keen drift

subtle peak Sep 23, 2021, 5:01 PM

#

Yes, much appreciated @keen drift.

keen drift Sep 23, 2021, 5:06 PM

#

Which version are you prototyping?

#

allow incomplete or default incomplete?

elder sage Sep 23, 2021, 5:28 PM

#

we did "default_incomplete"

#

and we just got word back that someone opted our account into the CAPTCHA requirement

#

that it was a mistake on Stripe's side

#

that bit has been toggled off and it appears that we are operational again

keen drift Sep 23, 2021, 5:31 PM

#

Awesome - ok that's great news

subtle peak Sep 23, 2021, 5:40 PM

#

Thanks for the help @keen drift! (Also, seriously nice color scheme on your profile image.)

keen drift Sep 23, 2021, 5:51 PM

#

😄

#

Quite welcome - I'm glad to hear we were able to get you unblocked, apologies for being coy about it here.

#

We'll be in touch about this with more detail later, so watch for emails from us.

#supercodepoet-payment-request