stripe-best-practices

Use the Checkout Sessions API via checkout.sessions.create for one-time payments. Omit payment_method_types entirely so Stripe dynamically shows the most relevant payment methods, and handle fulfillment in a webhook handler for checkout.session.completed.

Use Checkout Sessions for on-session payments since it handles discounts, shipping, and tax automatically. Use PaymentIntents for off-session payments or when you need to model checkout state independently. Never use the deprecated Charges API.

Create connected accounts with the Accounts v2 API (POST /v2/core/accounts), never the deprecated type: express/custom/standard pattern. Marketplaces default to dashboard: express, destination charges, and application as fees_collector and losses_collector.

Zero tax usually means automatic_tax is enabled without an active registration in the customer's jurisdiction, or the product has a Nontaxable tax code. Check the line item's taxability_reason and verify registrations with the Tax Registrations API.

Yes, webhooks are required for subscriptions because renewals, failed payments, and cancellations happen asynchronously after checkout. Handle customer.subscription.*, invoice.paid, and invoice.payment_failed events, and always verify webhook signatures.

Use a restricted API key (rk_ prefix) with only the permissions your integration needs, following least privilege. Store keys in a secrets vault like AWS Secrets Manager or Azure Key Vault, never in source code or client-side code.