integrate-payment-gateway

Install the official Stripe SDK, create a payment intent with amount and currency, confirm via the client SDK, and handle the webhook to update order status. Enable automatic_payment_methods so the UI renders available methods dynamically.

Compute an HMAC over the raw, unparsed request payload and compare it with constant-time comparison such as crypto.timingSafeEqual or hmac.compare_digest. Reject events with timestamps older than 300 seconds to block replay attacks.

Use a unique idempotency key (UUID per transaction attempt) for every charge or capture call. For webhooks, add a unique database index on provider, event_id, and event_type plus a distributed lock during event processing.

The approach covers Stripe, VNPay, PayPal, Momo, and similar providers, always using the official SDK rather than hand-rolled HTTP calls. It also covers A2A pay-by-bank rails such as TrueLayer, Plaid, or Stripe Pay by Bank.

Yes, via HTTP 402 Payment Required responses with payment headers, or Stripe Machine Payments Protocol (MPP) and SetupIntents configured with setup_future_usage set to off_session for charging stored methods programmatically.

Never log, store, or return raw card numbers, CVV, or full PAN data. Store only tokenized references such as customer_id and payment_method_id, and prefer EMVCo network tokens over raw PAN.