#AC_work-android-terminal
plain zenith
Hi there! There are various things that you can't do from the client-side, so it is necessary to have a backend for those requests to the Stripe API. Otherwise you would be opening up yourself for bad actors!
wet temple
But isn't this package designed to handle this? https://stripe.dev/stripe-android/payments-core/com.stripe.android/-stripe/index.html
Here is the actual sdk https://github.com/stripe/stripe-android
I am sorry I am just confused
plain zenith
Not quite. When using Stripe Terminal you will have a backend server, a client-side app either web or mobile, and your point of sale Terminal device.
wet temple
So if I am understanding you correctly. Do terminal transactions need to be handled differently then a "input your information" credit card transaction?
plain zenith
Kind of? It depends what you mean by that. With an online or mobile transaction you still are going to have a frontend controlling your app, just like you do with Terminal. You just don't have hardware in that case.
wet temple
But looking through the SDK you can create a Source Object that is defined in the android SDK it seems that you can make charges to it. So by using the Strip Android SDK it seems that you can do all your transactions. Is this correct? https://stripe.dev/stripe-android/payments-core/com.stripe.android.model/-source/index.html
cedar jacinth
Hi 👋 @plain zenith had to step away and I'm taking over. I would not advise attempting to handle all transactions on just the Android SDK. That is not what it was designed for.
cedar jacinth
If you are thinking of a web integration you've got
a) Client interface handling accepting payment info and some business logic
b) Server handling all secure components (creating payment intents, etc.)
With Terminal, you are adding a step prior to the client to allow the terminal device to get the payment details and transmit them to the client for submission to the server.
wet temple
Okay so you do not advise to use the android SDK how I mentioned in my last message?
cedar jacinth
I would not, no.
I would get started with fairly simple steps but still have all three components: server, client, device.
We have a good starting point here: https://stripe.com/docs/terminal/quickstart
wet temple
I just need to explain this to the other developer on my team. Can you give me any example why this is a bad idea? I like your web dev example
cedar jacinth
Well it's kind of like why you don't expose your private key in the JavaScript you have on your website. Sure the average user isn't going to see it or mess around with it. If you're lucky it will never be a problem. But it's a bad practice.
Also, the examples and code snippets across our docs are intended that you can copy/paste and tweak in your own integration.
But if you try to hack around the intended design none of that is going to work for you
To be clear, I'm still not 100% certain it would even work in the first place. But if it did, the amount of technical debt incurred when trying to update or change anything would be significant.
cedar jacinth
Happy to hear it 🙂