#stripe

hi i have a question

i have integrated android with stripe

do i need to make any changes to make the communication secure

like https

Hi irctc897. You'd need to make sure your app sends the card token to your server over HTTPS, yes

where can i find instructions of certs and communication related to stripe

my android app directly calls stripe api

irctc897: you need to use an external server. You can't embed your secret API key in your app. The only operation that should be done in the app itself is turning the card information into a token (using our Android SDK)

i have the publisher and secret keys in my application server

android app, gets them from application server

i will create a card object and customer object in android code after collecting info from my app customer

irctc897: someone could decompile your app and retrieve the secret API key

irctc897: apart from card tokenization (which uses the publishable key), all API calls need to be issued from your server and not from the app itself

even if i get secret api key from server?

yes

so when i do new Stripe().create(card, publishable_key, tokenCallBack)

at this time

only a token is created in the app

it is not sent to stipe

is it so?

any help on that question

irctc897: correct

Hello

Is there a way to transfer funds from one connected account to another?

i am looking for some guidance how i might be able find the particular charges that are associated with a specific transfer through the API

Hello

I have a query about customer id creation

Is there anyone to help out

hi Chetan, I can try to answer

hi

Hello Ants

might not be a technical question but I was wondering if I use stripe.js does that eliminate the need for a ASV scan?

stupid PCI compliance

Hi gtripoli. You'd need to use the "list balance history" call with the `transfer` parameter: https://stripe.com/docs/api#balance_history

hey Ants

Hi Ants. Could you clarify what you mean by "ASV scan"?

Ants: as long as you're using Stripe.js or Checkout and serving your page over SSL (and not storing card numbers some other weird way) you should be okay: https://support.stripe.com/questions/do-i-need-...

Hi Chetan, sorry for the delay. What's your question?

Ants: Unless you feel you're so self-compliant that you're doing all your security practices right the first time around, then its safe to say that following an external set of compliance standards is not stupid.

i personally think that the so called set of standards are over bearing for SMB

we've spent a month trying to figure it out

our current payment processor is WorldPay

if you pulled out a RACI sheet - it almost seems like no one wants to be accountable

WP wants customer to be accountable

and go to hosting provider to check that theyre compliant

hosting provider says we dont do that.... you should check with payment processing

its a huge loop

loop in a QSV(?)

Ants: ultimately, merchants are responsible for PCI compliancy, but Stripe makes it easy to be compliant

they say scan the server

@ywain : How does stripe creates the customer id

How is it unique is it based on email id ? or card ?

Chetan: like all IDs, it's just a random unique string

What in case of recurring payments

ywain, thats what im looking for right now... I just want to accept payment for patients and remove the whole quarterly scan requirement

Chetan: no, you can create a customer without any parameters at all. Stripe simply generates a unique ID whenever a new resource needs to be created

we are a small dr office

we'd have to jump up to dedicated hosting apparently to be able to scan our site

if the payment fails for the particular customer in recurring case

how to handle that

even rackspace cloud doesnt allow scanning

I updated my deposit account info over a week ago and my deposits continue to go to the wrong account...I've emailed for help but have no response,...I need help ASAP

Ants: if you used stripe.js, you'd be eligible for SAQ-A, which requires an ASV scan only when the acquirer says it's required (which stripe does not)

Chetan: that wouldn't change the customer ID. To be notified of failed or successful recurring payments, you'd need to use webhooks and catch the `invoice.payment_failed` / `invoice.payment_succeeded` events

Chetan: as an example: https://stripe.com/docs/recipes/sending-emails-...

thanks tr12!

how the customer id is not changed at stripe end , is it a combination of email and card no

np

Chetan: the customer ID is a string that uniquely identifies the customer. It is generated by Stripe when the customer is created and never changes later

If it keeps on failing for particular customer id , then how to handle it in recurring payment

So customer can login to stripe and change the card details , is it something like that

Chetan: no, you'd need to set up a form on your site to collect the new card information (with Stripe.js or Checkout, like you did when you first created the customer) and update the customer object with the new token in the `source` parameter: https://stripe.com/docs/api#update_customer

So in any case customer id would be same

Chetan: yes. You'd use the customer ID to retrieve the customer object and update it with the new card token

Thats nice

So we should have one to one mapping for the customer id and our users

even in the case of recurring payments

yes

Chetan: yes. when you first create the customer, you need to save the ID, and you'd likely want to associate it with your own user record

Thats nice

@ywain : Really thanks .

Glad I could help :)

It helped me alot

Could you give me any mail id where in I can reach you , if I have any difficulty

Chetan: you can reach my colleagues and I using the form at https://support.stripe.com/email, or support@stripe.com

Thanks

@ajs : Thanks

Chetan: did you send a message about half an hour ago?

Yes

Message or mail

Chetan: I meant an email, I'm seeing a message with the same question you asked here :)

Yes

:)

I also need the help about webhooks

About there response , various response

Chetan: sure. You can find the documentation about webhooks here: https://stripe.com/docs/webhooks. There are various types of events: https://stripe.com/docs/api#event_types. For recurring payments, `invoice.payment_failed` and `invoice.payment_succeeded` are probably the ones you want to catch

in which time zone does stripe works for recurring payment

Chetan: Stripe will attempt the payment as close as possible to the original subscription creation, e.g. if you create a subscription to a monthly plan on the 5th at 1pm, then Stripe will try to charge this customer every 5th of the month at 1pm. Though it's possible the payment might be delayed by a few minutes or hours sometimes

Chetan: all timestamps are in UTC

Okay

in the api, anyway - you can set your dashboard to be in whatever timezone you like

Chetan: and yes, in the API, all timestamps are in UTC as tr12 said. In the dashboard, timestamps are converted to your timezone that you set in your account settings

Okay

damn, too slow :)

Thanks

:P

@ywain : how to setup the clock in UTC

Chetan: you mean in your server-side code? Most languages offer facilities to create timestamps in UTC. What language are you using?

Java