Unit V · Money and limits
Taking payments without holding cards
Let a payment processor handle card details. Your app only needs to know, reliably, that a payment happened.
Keep card numbers off your server
The PCI Data Security Standard applies to every business that stores, processes or transmits cardholder data. A processor's hosted checkout or payment page sends card numbers straight to the processor, which keeps them off your server and greatly reduces what you must secure.
Trust the server-to-server notice, not the redirect
After paying, the buyer is sent back to your site, but that return visit can be faked or never happen. Processors also send a webhook: a message from their server to yours. Verify it (PayPal, Stripe and others document how to check that a webhook really came from them), check the amount and currency, and only then mark the order paid.
Handle the same notice twice
Webhooks can arrive more than once. Record each event's id and ignore repeats, so one payment never turns into two orders or two months of access.
Words to know
- PCI DSS
- the card industry's data security standard
- Hosted checkout
- a payment page run by the processor
- Webhook
- a server-to-server notice about an event
- Idempotent
- safe to receive twice with the same result
Sources
- PCI Security Standards Council: PCI DSS
- PayPal Developer: Webhooks
- Stripe Docs: Receive Stripe events in your webhook endpoint
Checked October 17, 2026. Pages on other sites change; if a source no longer says what the lesson says, the source wins.