Sign in Talk to us Free trial
Free trial

Design and software studio
Colour

Take card payments on invoices with your own Stripe account

Save your own Stripe key once, make a payment link for an invoice, and let the customer pay from a page in your name.

For
OwnerService advisor
Hosting
Any hosting
Devices
All devices
Business
All businesses

Checked against Pop Dispatch 0.1.0

Each business uses its own Stripe account, so card payments go straight to you. Pop Dispatch asks Stripe for a checkout page for the invoice balance and keeps the address. The customer opens a page in your name, logo and colours and pays on Stripe's secure page.

Before you start #

  • You need your own Stripe account and its secret key (it starts with sk_test_ or sk_live_; a restricted key starting rk_ also works).
  • Only the owner saves or removes the key. Managers and advisors can make payment links once the key is saved.
  • Save your public base address in settings so the pay page opens from outside the office.

Steps #

  1. The owner saves the secret key. Pop Dispatch seals it with a key derived from the vault's data key, tied to your business. It is never shown again; only the mode (test or live) and the last four characters appear.
  2. Open an invoice with a balance and make its payment link. Pop Dispatch asks Stripe for a checkout page for the balance and saves the address.
  3. Send the customer the pay page address. It shows the invoice number, the total, what is paid, the balance and a button that opens Stripe's page. After they pay, the page shows that the payment is being confirmed.
  4. The printed invoice shows the Stripe address under "Pay online" while a balance remains.
  5. To stop taking payments, the owner removes the key.
Technical details
  • Routes: GET, PATCH and DELETE /settings/payments/stripe (owner only); POST /invoices/:id/payment-link (Money group); GET /pay/:token (public).
  • The checkout request is built by the billing core's checkout function, so the amount, currency and invoice reference come from one place. The server calls Stripe through one HTTP layer, and tests replace that layer, so no test reaches the network.
  • The key is stored sealed in the business's settings area, is sent only as the bearer credential on the call to Stripe, and is left out of logs, audit entries, answers and error messages. When Stripe refuses a request, the answer names only the status and the error code.
  • An address from Stripe that does not start with https is refused.
  • Card payments are recorded on the invoice by Stripe's webhook once the owner saves the signing secret (see card-payments-setup). Without it, staff record the payment with the existing payment route.

On the web console #

  1. The owner opens Settings, then "Online payments", types the Stripe secret key and chooses "Save the key". The page then shows the mode and the last four characters, and never the key itself. "Replace the key" and "Remove the key" are on the same page.
  2. Open an invoice with a balance. Under Payments, choose "Make a payment link". The page address appears with "Copy the address".
  3. When no key is saved, the page says to save one in Settings, Payments first. When the invoice has nothing left to pay, no link is made.
  4. In the demo the link opens a sample customer page with the invoice and its balance. The card step on that page waits for a real payment service connection.

More ways to use it #

If something goes wrong #

  • "Save the business's Stripe key in Settings, Payments first": the owner has not saved the key.
  • "That does not look like a Stripe secret key": paste the secret key, which starts with sk_ or rk_, and leave out the publishable key.
  • "The payment service answered 401": Stripe rejected the key. The owner saves a fresh key.
  • "This invoice has nothing left to pay": the invoice is paid or void.