How Online Payments Work

Taking money online involves card networks, banks, fraud checks, taxes and regulations. Stripe wraps this in an API so you can accept payments without storing card data yourself.

The flow

1. The customer enters payment details on a page hosted or embedded by Stripe.
2. Stripe authorises the payment with the card network and bank (including 3-D Secure checks when required).
3. Stripe tells your server the result through a webhook.
4. Your server grants access, ships the order or records the invoice as paid.
5. Funds arrive in your bank account on a payout schedule, minus fees.

Key Stripe objects

Test mode

Stripe has separate test and live keys. In test mode, use test cards such as 4242 4242 4242 4242 (any future expiry, any CVC) and cards that simulate declines or 3-D Secure. Never use real card numbers in test mode or test keys in production.

Security and compliance

Using Stripe Checkout or Stripe Elements means card numbers never touch your server, which keeps your PCI compliance burden minimal. Your responsibilities remain: protect your API keys, verify webhooks, serve your site over HTTPS and never log payment details.

Keys

• Publishable key (pk_...): safe in the browser.
• Secret key (sk_...): server only, in an environment variable. Restricted keys with limited permissions are even better for specific services.

Check yourself

• Why is the webhook, not the redirect, the source of truth for payment success?
• Which Stripe key may appear in browser code?
• How does using Checkout reduce your PCI scope?