Stripe

Stripe lets staff send a customer a payment link or take a card over the phone through a Stripe-hosted form, and refunds run from the order screen without opening Stripe. This page is the full setup tutorial. For how Stripe compares to Paymentsense, see Payment integrations.

​

What it does

Stripe gives you two ways to take a card, both hosted by Stripe, so your shop never holds card details.

• Payment Link. Generate a one-shot link tied to a specific order and send it to the customer. The link can only be paid once; once it’s been used, it expires automatically. You can cancel an outstanding link from the order if you sent it in error.
• Hosted card entry. Open a Stripe-hosted card form inside your dashboard while you’re on the phone to the customer. The form runs in the browser and posts the result back to the order.

At least one of these flows must be enabled when you connect Stripe. You can have both on at the same time. Refunds work both ways. A refund started from the order screen calls Stripe directly and updates the order’s ledger. Refunds you start in the Stripe dashboard, asynchronous refunds that settle later, and funds movements from a disputed charge are all reconciled back into the order so the totals line up either way.

​

Before you start

• You need a Stripe account with payments activated. Sign up at stripe.com if you don’t have one — activation involves verifying your business details with Stripe and can take a day or two.
• If you’re turning on hosted card entry, ask Stripe support to enable MOTO payments on your account first — see MOTO and hosted card entry for exactly what to ask for (there’s a message you can copy and paste). Stripe support can take a few days, so start this early; payment links don’t need MOTO, so you can set them up while you wait.
• Keep two browser tabs open: Digital Florists (Settings > Integrations > Stripe) and the Stripe Dashboard. You’ll be copying values between them.

​

Setting it up

​

Using a restricted key

A restricted key (starts rk_test_ or rk_live_) is a Stripe key scoped to only the permissions it needs, so it’s the safer choice for the Secret or Restricted Key field. If the key ever leaked, it couldn’t be used to touch the rest of your Stripe account. Create one in the Stripe Dashboard under Developers > API keys > Create restricted key, and grant these permissions (on the restricted-key screen, Write automatically includes Read for the same resource):

• Payment Intents — Write, for taking a card over the phone.
• Payment Links — Write, for creating and cancelling payment links. Stripe also records a price in your account for each link, so if creating a link fails with a permissions error, grant Products — Write as well.
• Charges and Refunds — Write, for issuing refunds from the order screen and reading them back so they reconcile onto the right order. Stripe treats charges and refunds as one resource, so this covers both.
• Webhook Endpoints — Write, so Digital Florists can create and maintain your webhook automatically when you save. If you’d rather not grant this, leave it off — you’ll be prompted to create the webhook by hand and paste its signing secret instead (see the note in step 3 above).

If the restricted-key screen feels like too much, a standard secret key works exactly the same — restricted is recommended, not required.

​

Webhook events

Digital Florists subscribes your webhook to these events automatically. They’re listed here so you can check the endpoint in Stripe, or select them yourself if you’re creating the webhook by hand. They’re how Stripe tells Digital Florists a payment landed, failed, or was refunded or disputed: Missing events are the most common cause of a payment that went through on Stripe but never updated the order. If in doubt, re-open the endpoint in Stripe’s Webhooks tab and check all of the above are selected.

​

Disputes and chargebacks

When a customer disputes a Stripe charge, the order is flagged for review and the payment moves into a Disputed state. Stripe holds the funds while the dispute is open, and that movement is recorded against the order’s ledger. If the dispute is resolved in your favour, the funds are reinstated. If it’s lost, the withdrawal stays recorded against the order as a refund so the order and Stripe agree. These updates arrive through the four charge.dispute.* events listed under Webhook events, so the order only stays in step with Stripe while that subscription is in place.

​

Currency notes

Stripe handles most currencies, with a couple of edges worth knowing about.

• Zero-decimal currencies (Japanese yen, Korean won, and similar) are charged as whole units.
• Three-decimal currencies (Bahraini dinar, Kuwaiti dinar, and similar) aren’t supported. The integration rejects them rather than risk charging the wrong amount.
• The minimum charge Digital Florists will send to Stripe is £0.10 (or the equivalent). Stripe itself enforces a higher minimum on most currencies, typically around £0.30 in GBP.

​

PCI compliance and MOTO

​

Your PCI position with this integration

Both Stripe flows (the payment link page and the hosted card form) are hosted by Stripe, so card numbers never pass through your shop’s systems. Stripe spells out which compliance steps apply to your shop, and where to check is below. Confirm your status once a year in the Stripe Dashboard under Settings > Compliance and documents > My PCI compliance — dashboard.stripe.com/settings/compliance/documents. Stripe shows there whether it needs anything from you, and the Stripe documents tab on the same screen holds Stripe’s own PCI Attestation of Compliance and responsibility matrix if your acquirer or insurer ever asks for them.

​

MOTO and hosted card entry

MOTO (mail order / telephone order) is the card-scheme category for payments where you key in a card the customer reads out, and it’s exactly what hosted card entry does. Stripe keeps MOTO switched off by default until you ask support to enable it, because MOTO payments skip the online authentication step (3-D Secure) that normally protects card-not-present charges. Until Stripe enables it, hosted card entry fails when you take the payment, with:

Telephone payments (MOTO) are not enabled on your Stripe account. Ask Stripe support to enable MOTO for card payments through the Payment Intents API, then try again.

Payment links are unaffected — they authenticate the customer directly, so they work with or without MOTO.

​

What to ask Stripe for

Stripe has more than one thing called MOTO, and support conversations go wrong when the request is vague. Contact Stripe support from the Dashboard (Help in the top bar) and send them something like this:

Please enable MOTO (mail order and telephone order) payments on this account for card payments taken through the Payment Intents API — the setting on the API’s card options, sometimes written as payment_method_options[card][moto]. We take telephone orders through our shop management software (Digital Florists), which collects the card in Stripe’s own hosted payment form, so card details go directly to Stripe and never pass through our software or our software vendor’s servers. Please enable it for live mode.

Three details that save days of back and forth:

• It’s the API switch you need. MOTO for Stripe Terminal (keying a card into a Stripe card reader) and manual entry in the Stripe Dashboard are separate enablements — neither switches on API MOTO. If Stripe says “MOTO is already enabled” but hosted card entry still shows the message above, one of these look-alikes is the usual reason: go back and quote the exact wording above.
• Enablement is per Stripe account. If your business has more than one Stripe account, it must be enabled on the account whose API keys are pasted into Digital Florists — check the account name shown in the top-left of the Stripe Dashboard matches the account you set up here. The failed attempts are visible in that account’s Workbench > Logs, which is a quick way to confirm you’re looking at the right one.
• Test and live are switched separately, and Stripe doesn’t apply the gate in test mode at all — so a successful trial with test keys doesn’t mean live is enabled.

​

If Stripe asks for PCI paperwork

Stripe may ask for compliance documentation before enabling MOTO — typically a Self-Assessment Questionnaire (SAQ) for your shop, or an Attestation of Compliance (AoC) covering your shop or your software vendor, uploaded under Settings > Compliance and documents. Don’t be put off if the first reply quotes “SAQ D”, the longest questionnaire. Which questionnaire applies is Stripe’s call, and it depends on how card details are collected — so make sure Stripe knows how yours are. Two replies keep the request moving:

• Tell Stripe how the card is collected. The card form is hosted by Stripe, so card details never pass through your software or your software vendor’s servers. Reply along these lines: “All card entry is through Stripe’s own hosted payment form, so card details go directly to Stripe and never pass through our software or our software vendor’s servers. Which self-assessment applies to a fully hosted setup like this?”
• Use what’s already in your Dashboard. The Compliance and documents page walks you through completing the questionnaire Stripe expects for your account, and its Stripe documents tab holds Stripe’s own Attestation of Compliance if support asks for the provider’s paperwork.

Digital Florists is the software vendor in Stripe’s questions, so get in touch with us when the compliance question comes up. Send a copy of what Stripe asked for and we’ll work through it with you rather than leave you translating it alone.

​

Common questions

​

What’s next?