stripe-best-practices

Use Checkout Sessions for on-session payments, including one-time purchases and subscriptions, since it handles discounts, shipping, and tax automatically. Use PaymentIntents for off-session payments or when you need to model checkout state independently.

Use the Accounts v2 API (POST /v2/core/accounts) with configuration.recipient requesting stripe_transfers, dashboard set to express, and destination charges with application_fee_amount. Never use deprecated v1 account types like express, custom, or standard in account creation.

The most common cause is no active tax registration in the customer's jurisdiction; Stripe collects nothing and returns no error. Check the line item's taxability_reason, verify the product tax code is not Nontaxable, and confirm registrations via the Tax Registrations API.

No, omit payment_method_types entirely so Stripe dynamically shows the most relevant payment methods based on currency, location, and amount. The only exception is Terminal in-person payments, which require ['card_present']. Use payment_method_configurations to customize methods instead.

Yes, webhooks are required for subscriptions because renewals, failed payments, and cancellations happen asynchronously after checkout. Handle customer.subscription.*, invoice.paid, and invoice.payment_failed events, and always verify webhook signatures before processing.

Restricted API keys (rk_ prefix) have only the permissions you assign, limiting damage if compromised, while secret keys (sk_ prefix) grant full account access. Default to restricted keys with least-privilege permissions, stored in a secrets vault rather than source code.