Payment Gateway Integration

Integrate secure payment processing with proper error handling and compliance.

Stripe Integration (Node.js)

const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);

class PaymentService { async createPaymentIntent(amount, currency, customerId) { return stripe.paymentIntents.create({ amount: Math.round(amount * 100), // Convert to cents currency, customer: customerId, automatic_payment_methods: { enabled: true } }); }

async createSubscription(customerId, priceId) { return stripe.subscriptions.create({ customer: customerId, items: [{ price: priceId }], payment_behavior: 'default_incomplete', expand: ['latest_invoice.payment_intent'] }); }

async refund(paymentIntentId, amount = null) { const params = { payment_intent: paymentIntentId }; if (amount) params.amount = Math.round(amount * 100); return stripe.refunds.create(params); } }

Webhook Handling

app.post('/webhooks/stripe', express.raw({ type: 'application/json' }), (req, res) => { const sig = req.headers['stripe-signature'];

let event; try { event = stripe.webhooks.constructEvent(req.body, sig, process.env.STRIPE_WEBHOOK_SECRET); } catch (err) { return res.status(400).send(Webhook Error: ${err.message}); }

switch (event.type) { case 'payment_intent.succeeded': await handlePaymentSuccess(event.data.object); break; case 'invoice.payment_failed': await handlePaymentFailed(event.data.object); break; }

res.json({ received: true }); });

PayPal Integration

See references/paypal-integration.md for complete PayPal implementation with:

• Order creation and capture

• Refund processing

• Webhook handling

• Frontend SDK integration

• Success/cancel callbacks

Security Checklist

• Use official SDK only

• Verify webhook signatures

• Never log full card numbers

• Store minimal payment data

• Test in sandbox first

• HTTPS for all payment routes

• Handle all error cases

• Use idempotency keys

• Implement retry logic

Best Practices

Do:

• Use official SDK libraries

• Verify all webhook signatures

• Log transaction IDs (not card data)

• Test in sandbox environment

• Handle all payment states

• Implement proper error messages

Don't:

• Process raw card data directly

• Store sensitive payment info

• Hardcode API keys

• Skip webhook signature validation

• Ignore failed payment events

• Use test keys in production