stripe-best-practices

Use Checkout Sessions for on-session payments since it handles taxes, discounts, and shipping automatically. Use PaymentIntents for off-session payments or when you need to model checkout state independently and just create a charge.

Use the Accounts v2 API (POST /v2/core/accounts) and configure accounts with controller properties for liability, fees, dashboard access, and requirement collection. Avoid legacy account types like Express or Custom for new platforms.

Omitting payment_method_types enables dynamic payment methods, where Stripe automatically shows the most relevant methods per customer to maximize conversion. The only exception is Terminal integrations, which require card_present.

Restricted API keys (rk_ prefix) carry only the permissions you assign, limiting damage if compromised, while secret keys (sk_ prefix) grant full account access. Best practice is to use a separate least-privilege restricted key per service.

Migrate to Checkout Sessions or PaymentIntents, which are the supported paths for new integrations. The Charges API should never be used, and the Sources API should be replaced with Setup Intents for saving cards.

Stripe Tax supports many regions for sales tax, VAT, and GST, but not all jurisdictions or tax types like customs duties. Check the supported countries list; unsupported regions require manual tax_rates on subscriptions or invoices.