#Lord-Y-paymentintents
sacred vapor
cedar stag
ok
final mulch
Hey there stepping in for karbi who needs to step away, reading above now
What is your specific concern?
Nobody can call the Stripe API (including modifying metadata) unless they have your secret key
these are server requests
cedar stag
I mean if you make a post to yourdomain.com/api/xxxx/pay with the publishable key
I just want to be sure that stripe will somehow kick this kind of request
final mulch
this is your own API, which internally interacts with Stripe?
cedar stag
yes
final mulch
if your customer can induce your server to make requests, and the requests come from your server using your secret key, Stripe wouldn't know whether these are intentional or not. You need to ensure your own API is secure from misuse
cedar stag
not the answer I was expected
from the example
you have a frontend and a backend
from your frontend you can reach your backend as you have to make a post to /pay endpoint example
final mulch
What front end are you referring to?
Which server are you referring to? You described your own API endpoints, but now saying "your backend" it sounds like you're referring to Stripe's API?
Can you illustrate with a specific example/sequence?
cedar stag
sure
cedar stag
Okay, nevermind. After thinking again, I'll try the checkout session https://stripe.com/docs/payments/accept-a-payment . Thx for your help 🙂
final mulch
NP!