Payments, fees and webhooks

The contract

Takes an amount. Returns a verified payment, once only.

Name	What it does
providers	stripe, paypal or both. Passed to paymentCspSources and decides which routes the app adds.
stripeLivemode	true on a live site and false on a test site. A Stripe event from the other mode is ignored. Passed to handleStripeWebhook as livemode. When it is not set, every Stripe webhook is answered 500.
paypalEnvironment	live or sandbox. Passed to every PayPal call. Use sandbox only on a test site.
feeSchedule	The provider's rate in basis points and fixed fee in minor units, from its price page, for feeFor and grossFor.
webhookToleranceSeconds	How old a signed Stripe webhook may be, passed to handleStripeWebhook as toleranceSeconds. Defaults to 300.

An amount is held as a whole number of cents, never a decimal, so a payment is never off by a fraction.

Amount

Currency

The rate is a setting taken from the provider's price page. These numbers are only an example.

What to work out

The fee on a payment

What to charge so the full amount is received

Payment in AUD

Rate in basis points

Fixed fee in cents

With this rate, the smallest payment that leaves anything over is AUD 0.32.

These go to the security headers block, so each provider's scripts and frames load and nothing else does.

Stripe

PayPal

PayPal test site as well

script-src: https://js.stripe.com https://*.js.stripe.com
frame-src: https://js.stripe.com https://*.js.stripe.com https://hooks.stripe.com https://checkout.stripe.com
connect-src: https://api.stripe.com https://m.stripe.network
img-src: https://*.stripe.com
form-action: https://checkout.stripe.com

The signed event below was made with a demo secret in your browser. No provider is called.

The body as it arrived

Pretend it arrived ten minutes late

Check the signature, then change one character of the body and check again.