Stripe

Stripe lets staff send a customer a payment link or take a card over the phone through a Stripe-hosted form, and refunds run from the order screen without opening Stripe. This page is the full setup tutorial. For how Stripe compares to Dojo and Paymentsense, see Payment integrations.

​

What it does

Stripe gives you two ways to take a card, both hosted by Stripe, so your shop never holds card details.

• Payment Link. Generate a one-shot link tied to a specific order and send it to the customer. The link can only be paid once; once it’s been used, it expires automatically. You can cancel an outstanding link from the order if you sent it in error.
• Hosted card entry. Open a Stripe-hosted card form inside your dashboard while you’re on the phone to the customer. The form runs in the browser and posts the result back to the order.

At least one of these flows must be enabled when you connect Stripe. You can have both on at the same time. Refunds work both ways. A refund started from the order screen calls Stripe directly and updates the order’s ledger. Refunds you start in the Stripe dashboard, asynchronous refunds that settle later, and funds movements from a disputed charge are all reconciled back into the order so the totals line up either way.

​

Before you start

• You need a Stripe account with payments activated. Sign up at stripe.com if you don’t have one — activation involves verifying your business details with Stripe and can take a day or two.
• If you’re turning on hosted card entry, ask Stripe support to enable MOTO payments on your account first — see MOTO and hosted card entry. Payment links don’t need this.
• Keep two browser tabs open: Digital Florists (Settings > Integrations > Stripe) and the Stripe Dashboard. You’ll be copying values between them.

​

Setting it up

​

Using a restricted key

A restricted key (starts rk_test_ or rk_live_) is a Stripe key scoped to only the permissions it needs, so it’s the safer choice for the Secret or Restricted key field. If the key ever leaked, it couldn’t be used to touch the rest of your Stripe account. Create one in the Stripe Dashboard under Developers > API keys > Create restricted key, and grant these permissions (on the restricted-key screen, Write automatically includes Read for the same resource):

• Payment Intents — Write, for taking a card over the phone.
• Payment Links — Write, for creating and cancelling payment links.
• Charges and Refunds — Write, for issuing refunds from the order screen and reading them back so they reconcile onto the right order. Stripe treats charges and refunds as one resource, so this covers both.
• Webhook Endpoints — Write, so Digital Florists can create and maintain your webhook automatically when you save. If you’d rather not grant this, leave it off — you’ll be prompted to create the webhook by hand and paste its signing secret instead (see the note in step 3 above).

If the restricted-key screen feels like too much, a standard secret key works exactly the same — restricted is recommended, not required.

​

Webhook events

Digital Florists subscribes your webhook to these events automatically. They’re listed here so you can check the endpoint in Stripe, or select them yourself if you’re creating the webhook by hand. They’re how Stripe tells Digital Florists a payment landed, failed, or was refunded or disputed: Missing events are the most common cause of a payment that went through on Stripe but never updated the order. If in doubt, re-open the endpoint in Stripe’s Webhooks tab and check all of the above are selected.

​

Disputes and chargebacks

When a customer disputes a Stripe charge, the order is flagged for review and the payment moves into a Disputed state. Stripe holds the funds while the dispute is open, and that movement is recorded against the order’s ledger. If the dispute is resolved in your favour, the funds are reinstated. If it’s lost, the withdrawal stays recorded against the order as a refund so the order and Stripe agree. These updates arrive through the four charge.dispute.* events listed under Webhook events, so the order only stays in step with Stripe while that subscription is in place.

​

Currency notes

Stripe handles most currencies, with a couple of edges worth knowing about.

• Zero-decimal currencies (Japanese yen, Korean won, and similar) are charged as whole units.
• Three-decimal currencies (Bahraini dinar, Kuwaiti dinar, and similar) aren’t supported. The integration rejects them rather than risk charging the wrong amount.
• The minimum charge Digital Florists will send to Stripe is £0.10 (or the equivalent). Stripe itself enforces a higher minimum on most currencies, typically around £0.30 in GBP.

​

PCI compliance and MOTO

​

Your PCI position with this integration

Both Stripe flows (the payment link page and the hosted card form) are hosted by Stripe, so card numbers never pass through your shop’s systems. That keeps you in the simplest PCI compliance band, with Stripe doing the heavy lifting. Confirm your status once a year in the Stripe Dashboard under Settings > Compliance and documents > My PCI compliance — dashboard.stripe.com/settings/compliance/documents. Stripe shows there whether it needs anything from you, and the Stripe documents tab on the same screen holds Stripe’s own PCI Attestation of Compliance and responsibility matrix if your acquirer or insurer ever asks for them.

​

MOTO and hosted card entry

MOTO (mail order / telephone order) is the card-scheme category for payments where you key in a card the customer reads out, and it’s exactly what hosted card entry does. Stripe keeps MOTO switched off by default until you ask support to enable it, because MOTO payments skip the online authentication step (3-D Secure) that normally protects card-not-present charges. Until Stripe enables it, hosted card entry fails at the “Prepare card payment” step with:

Telephone payments (MOTO) are not enabled on your Stripe account. Ask Stripe support to enable mail order and telephone order payments, then try again.

Payment links are unaffected — they authenticate the customer directly, so they work with or without MOTO. When you contact Stripe support, be precise about what you’re asking for, because Stripe has more than one thing called MOTO:

• Ask for MOTO to be enabled for card payments taken through the Payment Intents API (sometimes described as MOTO for the API or for Stripe Elements).
• MOTO for Stripe Terminal (keying a card into a Stripe card reader) is a separate enablement and does not switch on API MOTO. If Stripe says “MOTO is already enabled” but hosted card entry still shows the message above, this mismatch is the usual reason.
• Enablement is per Stripe account. If your business has more than one Stripe account, it must be enabled on the account whose API keys are pasted into Digital Florists — check the account name shown in the top-left of the Stripe Dashboard matches the account you set up here. The failed attempts are visible in that account’s Workbench > Logs, which is a quick way to confirm you’re looking at the right one.

Stripe may ask for compliance documentation as part of the request — typically a Self-Assessment Questionnaire (SAQ) for your shop, or an Attestation of Compliance (AoC) covering your shop or your software vendor, uploaded under Settings > Compliance and documents. Digital Florists is the software vendor in Stripe’s questions, so get in touch with us when you start the request and we’ll work through it with you rather than leave you translating it alone.

​

Caveats worth knowing

• The Stripe API version is pinned. Upgrading the API version in your Stripe dashboard won’t change how Digital Florists talks to Stripe; the integration tracks a fixed version that’s updated through our releases.
• Failed refunds are flagged for review. If Stripe rejects a refund after the fact (rare), the order is flagged on the dashboard with a note to action so you can decide what to do next.

​

Common questions

​

What’s next?