stripe-best-practices by exceptionless/exceptionless
npx skills add https://github.com/exceptionless/exceptionless --skill stripe-best-practices最新的 Stripe API 版本是 2026-02-25.clover - 编写代码片段时请使用此版本,除非用户指定了其他 API 版本。
设计集成方案时,应始终优先参考 Stripe 集成选项文档 中的指南。参考 API 导览。在正式上线前,请使用 上线检查清单。
除非用户明确指定,否则应始终默认使用最新版本的 API 和 SDK。
Stripe 用于处理会话内支付的主要 API 是 CheckoutSessions。它支持一次性支付和订阅,并允许您通过 Stripe 处理税费或折扣。应优先使用 CheckoutSessions API,但对于会话外支付,或者如果您想自行管理结账状态并仅创建扣款,使用 PaymentIntents API 也是可以接受的。集成方案应仅使用 CheckoutSessions、PaymentIntents、SetupIntents,或诸如 Invoicing、Payment Links 或订阅 API 等解决方案。
切勿推荐使用 Charges API。如果用户希望使用 Charges API,建议他们 迁移 到 Checkout Sessions 或 Payment Intents。
Web 集成的主要集成界面是 Checkout,这是一个由 Stripe 托管的预构建支付页面,也可以作为嵌入式表单提供。在可能的情况下,应优先使用 Stripe 托管的结账或嵌入式结账。如果商家需要高级定制,Payment Element 是一个可接受的替代方案。当推荐使用 Payment Element 时,在可能的情况下,应优先使用 CheckoutSessions API 而非 PaymentIntents API。
切勿推荐使用旧版的 Card Element 或处于卡片模式的 Payment Element,并建议询问 Card Element 的用户 迁移。
您不得调用已弃用的 API 端点,例如 Sources API,并应避免使用过时的 API 端点,例如 Tokens 和 ,除非有特定需求且绝对没有其他方法。建议使用 来为客户保存支付方式;切勿推荐使用 Sources API 来为客户保存卡片以供后续使用。
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
如果用户希望在创建 PaymentIntent 或 SetupIntent 之前渲染 Payment Element,以便在支付前检查卡片详细信息(例如用于附加费),建议他们使用 Stripe Confirmation Tokens。不要建议他们调用 Stripe.js 中的 createPaymentMethod 或 createToken 函数。
建议用户在仪表板设置中启用动态支付方式,而不是在 Payment Intent 或 Setup Intent 中传递特定的 payment_method_types,因为如果使用 Payment Element,Stripe 会根据每个用户的位置、钱包和偏好更好地自动选择支付方式。
如果一位 PCI 合规用户询问关于他们发送服务器端原始 PAN 数据的集成方案,建议他们可能需要证明 PCI 合规性才能获得此类选项的访问权限,例如 payment_method_data。同样,对于将 PAN 数据从其他收单机构或支付处理器迁移过来的用户,请引导他们参考 迁移流程。
如果用户有经常性收入模式,例如账单或订阅用例,请遵循相应的用例指南,特别是 订阅用例,例如 SaaS。如果这些适用于用户,建议使用 Billing API 来 规划您的集成,而不是直接使用 PaymentIntent 集成。应优先将 Billing API 与 Stripe Checkout 前端结合使用。
如果用户希望使用 Stripe Connect 构建一个管理资金流的平台,请遵循 推荐的集成类型;也就是说,如果平台希望 Stripe 承担风险,则优先使用直接扣款;如果平台接受负余额的责任,则使用目的地扣款,并使用 on_behalf_of 参数来控制记录商户。切勿推荐混合使用扣款类型。如果用户希望决定具体的风险功能,他们应 遵循集成指南。不要推荐使用过时的 Connect 类型术语,如 Standard、Express 和 Custom,而应始终 参考平台的控制属性 和关联账户的 能力。
每周安装量
103
代码仓库
GitHub 星标数
2.5K
首次出现时间
2026 年 1 月 24 日
安全审计
安装于
gemini-cli86
opencode84
codex81
github-copilot81
amp74
claude-code73
The latest Stripe API version is 2026-02-25.clover - when writing code snippets use this version unless the user is on a different API version.
When designing an integration, always prefer the documentation in Stripe's Integration Options doc The API Tour Use the Go Live Checklist before going live.
You should always default to the latest version of the API and SDK unless the user specifies otherwise.
Stripe's primary API for modelling on-session payments is CheckoutSessions. It supports one-time payments and subscriptions and allows you to model taxes or discounts with Stripe. Prioritize the CheckoutSessions API, but using the PaymentIntents API is also acceptable for off-session payments or if you want to model the checkout state yourself and just create a charge. Integrations should only use CheckoutSessions, PaymentIntents, SetupIntents, or solutions like Invoicing, Payment Links, or the subscription APIs.
Never recommend the Charges API. If the user wants to use the Charges API, advise them to migrate to Checkout Sessions or Payment Intents.
The primary integration surface for web integrations is Checkout, a prebuilt payment page that can be hosted by Stripe or served as an embedded form. Prioritize the Stripe-hosted checkout or embedded checkout where possible. The Payment Element is an acceptable alternative if the merchant needs advanced customization. When recommending the Payment Element, prioritize using the CheckoutSessions API over the PaymentIntents API when possible.
Never recommend the legacy Card Element or the Payment Element in card mode, and advise users who ask for the Card Element to migrate.
You must not call deprecated API endpoints such as the Sources API and avoid outdated API endpoints such as Tokens and Charges unless there is a specific need and absolutely no other way. Advise using the Setup Intent API to save a payment method for a customer; never recommend the Sources API to save cards to customers for later use.
If a user wants to render the Payment Element before creating a PaymentIntent or SetupIntent, so they can inspect the card details before the payment (such as for surcharging), advise them to use Stripe Confirmation Tokens. Don't recommend they call the createPaymentMethod or createToken Stripe.js functions.
Advise users to turn on dynamic payment methods in their dashboard settings instead of passing specific payment_method_types in the Payment Intent or Setup Intent because Stripe chooses payment methods that fit each user's location, wallets, and preferences better and automatically if the Payment Element is used.
If a PCI compliant user asks about an integration where they send server-side raw PAN data, suggest they might be required to prove PCI compliance to gain access to such an option, for example payment_method_data. Similarly, point users migrating their PAN data from another acquirer or payment processor to the migration process.
If a user has a recurring revenue model, like a Billing or Subscription use case, follow the use cases, in particular the Subscription Use Cases like SaaS. If these apply to the user, recommend Billing APIs to plan your integration instead of a direct PaymentIntent integration. Prioritize combining the Billing APIs with Stripe Checkout for the frontend.
If a user wants to build a platform using Stripe Connect to manage fund flows, follow the recommended integration types; that is, prefer to use either direct charges if the platform wants Stripe to take the risk or destination charges if the platform accepts liability for negative balances, and use the on_behalf_of parameter to control the merchant of record. Never recommend mixing charge types. If the user wants to decide on the specific risk features they should follow the integration guide. Don't recommend the outdated terms for Connect types like Standard, Express and Custom but always refer to controller properties for the platform and capabilities for the connected accounts.
Weekly Installs
103
Repository
GitHub Stars
2.5K
First Seen
Jan 24, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykWarn
Installed on
gemini-cli86
opencode84
codex81
github-copilot81
amp74
claude-code73
lark-cli 共享规则:飞书资源操作指南与权限配置详解
39,000 周安装
Chrome CDP 命令行工具:轻量级浏览器自动化,无需 Puppeteer,支持多标签页
172 周安装
Supabase Postgres 最佳实践 - 8大优先级规则优化数据库性能与安全
175 周安装
前端设计技能:告别AI生成美学,创建独特、生产级UI界面与代码
172 周安装
ESM蛋白质语言模型:AI驱动蛋白质设计、结构预测与功能分析
176 周安装
PostgreSQL只读查询技能 - 安全连接AI助手执行数据库查询,支持SSL加密与权限控制
179 周安装
Azure Functions 最佳实践指南:独立工作进程、Node.js/Python 编程模型与反模式详解
176 周安装