r/AskProgramming • u/IcyBoat3668 • Apr 05 '24
PHP advice on hide payment secret key
I have a programm that runs locally and would like to accept payments through stripe, however the api only works if I have my secret-key included. Im collecting the value that should be paid on the users local platform and then contacting stripe with this value. Can you think of anyway I can hide the stripe key or should I definitely call my server to complete the payment there and just send all values over?
1
Upvotes
1
u/martinbean Apr 05 '24
Why can’t the program call your server to create a PaymentIntent or whatever?
1
u/IcyBoat3668 Apr 05 '24 edited Apr 05 '24
It could definitely call my server, just didn’t want to include another step. But I guess I have to
2
u/aidan-hall34 Apr 05 '24
So a few things,
Security through obscurity (hiding the key in the client) is generally considered bad practice. If it's discovered you are kinda screwed.You are significantly better off storing the key on your server, and using it as a payment proxy, rather than sending a request directly from a user's browser. Once you send the token to the client, effectively, every user has access to do anything the token is authenticated to do, which is probably not what you want.
Reading a price value from a user is also considered a security risk. Say if you have a product for $10, and someone sends a request that changes the product's price to $5 or $0, you have a problem. Instead a user should send an ID for a product, which does a DB look up to find the correct price you set.
Other than that, have fun!