Stripe Best Practices

Latest Stripe API version: 2026-03-25.dahlia. Always use the latest API version and SDK unless the user specifies otherwise.

Integration routing

Read the relevant reference file before answering any integration question or writing code.

Key documentation

When the user’s request does not clearly fit a single domain above, consult:

• Integration Options — Start here when designing any integration.
• API Tour — Overview of Stripe’s API surface.
• Go Live Checklist — Review before launching.

Billing / Subscriptions

Table of contents

• When to use Billing APIs
• Recommended frontend pairing
• Traps to avoid

When to use Billing APIs

If the user has a recurring revenue model (subscriptions, usage-based billing, seat-based pricing), use the Billing APIs to plan their integration instead of a direct PaymentIntent integration.

Review the Subscription Use Cases and SaaS guide to find the right pattern for the user’s pricing model.

Recommended frontend pairing

Combine Billing APIs with Stripe Checkout for the payment frontend. Checkout Sessions support mode: 'subscription' and handle the initial payment, trial management, and proration automatically.

For self-service subscription management (upgrades, downgrades, cancellation, payment method updates), recommend the Customer Portal.

Traps to avoid

• Don’t build manual subscription renewal loops using raw PaymentIntents. Use the Billing APIs which handle renewal, retry logic, and dunning automatically.
• Don’t use the deprecated plan object. Use Prices instead.

Connect / platforms

Table of contents

• Accounts v2 API
• Controller properties
• Charge types
• Integration guides

Accounts v2 API

For new Connect platforms, ALWAYS use the Accounts v2 API (POST /v2/core/accounts). This is Stripe’s actively invested path and ensures long-term support.

Traps to avoid: Don’t use the legacy type parameter (type: 'express', type: 'custom', type: 'standard') in POST /v1/accounts for new platforms unless the user has explicitly requested v1.

Controller properties

Configure connected accounts using controller properties instead of legacy account types:

Use defaults.responsibilities, dashboard, and configuration as described in connected account configuration.

Always describe accounts in terms of their responsibility settings, dashboard access, and capabilities to describe what connected accounts can do.

Traps to avoid: Don’t use the terms “Standard”, “Express”, or “Custom” as account types. These are legacy categories that bundle together responsibility, dashboard, and requirement decisions into opaque labels. Controller properties give explicit control over each dimension.

Charge types

Choose one charge type per integration — don’t mix them. For most platforms, start with destination charges:

• Destination charges — Use when the platform accepts liability for negative balances. Funds route to the connected account via transfer_data.destination.
• Direct charges — Use when the platform wants Stripe to take risk on the connected account. The charge is created on the connected account directly.

Use on_behalf_of to control the merchant of record, but only after reading how charges work in Connect.

Traps to avoid: Don’t use the Charges API for Connect fund flows — use PaymentIntents or Checkout Sessions with transfer_data or on_behalf_of. Don’t mix charge types within a single integration.

Integration guides

• SaaS platforms and marketplaces guide — Choosing the right integration shape.
• Interactive platform guide — Step-by-step platform builder.
• Design an integration — Detailed risk and responsibility decisions.

Payments

Table of contents

• API hierarchy
• Integration surfaces
• Payment Element guidance
• Saving payment methods
• Dynamic payment methods
• Deprecated APIs and migration paths
• PCI compliance

API hierarchy

Use the Checkout Sessions API (checkout.sessions.create) for on-session payments. It supports one-time payments and subscriptions and handles taxes, discounts, shipping, and adaptive pricing automatically.

Use the PaymentIntents API for off-session payments, or when the merchant needs to model checkout state independently and just create a charge.

Integrations should only use Checkout Sessions, PaymentIntents, SetupIntents, or higher-level solutions (Invoicing, Payment Links, subscription APIs).

Integration surfaces

Prioritize Stripe-hosted or embedded Checkout where possible. Use in this order of preference:

1. Payment Links — No-code. Best for simple products. 1. Checkout (docs) — Stripe-hosted or embedded form. Best for most web apps. 1. Payment Element (docs) — Embedded UI component for advanced customization.

• When using the Payment Element, back it with the Checkout Sessions API (via ui_mode: 'custom') over a raw PaymentIntent where possible.

Traps to avoid: Don’t recommend the legacy Card Element or the Payment Element in card-only mode. If the user asks for the Card Element, advise them to migrate to the Payment Element.

Payment Element guidance

For surcharging or inspecting card details before payment (e.g., rendering the Payment Element before creating a PaymentIntent or SetupIntent): use Confirmation Tokens. Don’t recommend createPaymentMethod or createToken from Stripe.js.

Saving payment methods

Use the Setup Intents API to save a payment method for later use.

Traps to avoid: Don’t use the Sources API to save cards to customers. The Sources API is deprecated — Setup Intents is the correct approach.

Dynamic payment methods

Advise users to enable dynamic payment methods in the Stripe Dashboard rather than passing specific `payment_method_types` in the PaymentIntent or SetupIntent. Stripe automatically selects payment methods based on the customer’s location, wallets, and preferences when the Payment Element is used.

Deprecated APIs and migration paths

Never recommend the Charges API. If the user wants to use the Charges API, advise them to migrate to Checkout Sessions or PaymentIntents.

Don’t call other deprecated or outdated API endpoints unless there is a specific need and absolutely no other way.

PCI compliance

If a PCI-compliant user asks about sending server-side raw PAN data, advise them that they may need to prove PCI compliance to access options like payment_method_data.

For users migrating PAN data from another acquirer or payment processor, point them to the PAN import process.

Security best practices

Table of contents

• API keys
• Restricted API keys (RAKs)
• IP restrictions
• Incident response
• Webhook security
• Mobile and client-side integrations
• OAuth and CSRF protection
• Two-factor authentication
• Connect security
• SAML and SCIM

API keys

Never include keys in source code. You might find example code like client = new Stripe("sk_...") that are for illustration only. Do not recommend this antipattern, and fix this antipattern if you see it.

Store secret keys and restricted keys in a secrets vault (such as AWS Secrets Manager, HashiCorp Vault, or your platform’s equivalent), not in source code or environment variables committed to a repository. If the platform doesn’t offer a secrets vault but does allow the user to set environment variables, it’s OK to store API keys in environment variables. Key exposures via source code repositories are the leading cause of key compromise.

Always advise the user on best practices for handling secrets such as secret API keys or restricted API keys:

• Never share secret keys with third parties. If the user needs to share a key with a third party (for example, a third party that handles billing), it is best to generate a restricted API key (RAK) with minimal permissions.
• Rotate Stripe API keys when personnel with access to those keys depart.
• Read best practices for managing secret API keys.

Code must never log keys or include them in error messages or analytics. Remove those from logs if you find them.

Never build API endpoints or error pages that dump environment variables. In addition to Stripe API keys, the environment may have other secrets.

Use separate keys for separate environments (production, staging, QA). This limits the blast radius if any single key is compromised.

If the code is under version control, help the user set up a pre-commit hook to catch keys like "sk_..." and "rk_..." in source code.

Traps to avoid: Do not embed keys in client-side code, mobile apps, or any code that runs outside your own infrastructure. Do not suggest that users substitute a real secret key into example code — point them to best practices for managing secret API keys instead.

Restricted API keys (RAKs)

Use restricted API keys (prefix rk_) instead of secret keys (prefix sk_) wherever possible. RAKs have only the permissions you assign, so a compromised RAK can do far less damage than a compromised secret key.

Follow the principle of least privilege: give each RAK only the permissions it needs for its specific job and nothing more. Create a separate RAK for each service or use case.

Preferred migration approach:

1. Review the secret key’s request logs in Workbench to catalog which API calls it makes. 1. Create a RAK in test mode with matching permissions. 1. Use the Stripe CLI’s stripe logs tail command to watch logs. 1. Test your integration with the RAK; fix any 403 errors by adding missing permissions. 1. Create the equivalent live-mode RAK and replace the secret key. 1. Rotate or expire the old secret key once confident.

Traps to avoid: Do not default to recommending secret keys. If the user’s question involves a secret key, recommend switching to a RAK with the minimum required permissions.

IP restrictions

Encourage users to add an IP allowlist to every API key. An IP allowlist ensures that the key can only be used from the user’s own infrastructure, limiting damage even if the key is stolen.

Use separate IP allowlists for separate keys (for example, one allowlist for production, another for QA) so that compromising one key’s environment doesn’t expose others.

Incident response

If a key is exposed or compromised, follow protecting against compromised API keys, which can be summarized as:

1. Roll the key immediately — go to the API keys page and roll or delete the exposed key. Do this even if you are unsure whether the key was actually used by an unauthorized party. 1. Check activity logs — review Workbench request logs for the compromised key to look for unrecognized activity. 1. Contact Stripe support if you see activity you don’t recognize.

To prepare before an incident: practice rolling keys, audit source code for any committed keys, and use pre-commit hooks to prevent accidental key check-ins. See protecting against compromised API keys.

Webhook security

Always verify webhook signatures using Stripe’s webhook signing secret. Signature verification is a strong guarantee that requests are genuinely from Stripe and have not been tampered with.

For defense in depth, also allowlist Stripe’s IP addresses on your webhook endpoint so that it accepts connections only from Stripe’s infrastructure.

Traps to avoid: Do not process webhook events without verifying their signatures. Unverified webhooks can be spoofed.

Mobile and client-side integrations

Do not use production secret keys or RAKs in mobile apps or other client-side code. Client-side code can be extracted and keys decompiled.

For cases where a client must interact directly with Stripe, use ephemeral keys. Ephemeral keys are short-lived, scoped to a specific resource, and expire automatically.

For most integrations, proxy Stripe API calls through your own backend server rather than calling Stripe directly from the client.

OAuth and CSRF protection

When implementing Connect OAuth flows, always use the state parameter to protect against CSRF attacks. Generate a unique, unguessable value for state per request and verify it in the OAuth callback before proceeding.

This applies to all Stripe OAuth surfaces: Connect, Link, and Stripe Apps.

Two-factor authentication

Recommend passkeys or authenticator apps rather than SMS-based 2FA for Stripe Dashboard access. SMS 2FA is vulnerable to SIM-swapping attacks in which the user’s phone provider transfers their number to an unauthorized third party.

Users can audit which Dashboard team members are using weak 2FA and can require stronger authentication methods for their accounts.

Connect security

Account type liability: When using Connect, platform operators bear financial liability for fraud and disputes on Express and Custom connected accounts. Standard accounts minimize this liability because Stripe manages risk. Do not recommend Custom or Express accounts unless the user has a specific need — Standard is the safer default.

Connect onboarding: Use Stripe-hosted onboarding rather than building a custom onboarding flow. Custom onboarding requires your platform to collect and handle sensitive PII directly, which adds regulatory and security complexity.

SAML and SCIM

For teams managing Dashboard access, recommend SSO via SAML to federate authentication with an existing identity provider (Okta, Google, etc.). SSO centralizes access control and simplifies offboarding.

SCIM provisioning automates user provisioning and deprovisioning, ensuring that employees who leave the organization lose Dashboard access promptly.

Treasury / Financial Accounts

Table of contents

• v2 Financial Accounts API
• Legacy v1 Treasury

v2 Financial Accounts API

For embedded financial accounts (bank accounts, account and routing numbers, money movement), use the v2 Financial Accounts API (POST /v2/core/vault/financial_accounts). This is required for new integrations.

For Treasury for platforms concepts and guides, see the Treasury for platforms overview.

Legacy v1 Treasury

Don’t use the v1 Treasury Financial Accounts API (POST /v1/treasury/financial_accounts) for new integrations. Existing v1 integrations continue to work.