Stripe integration is one of the most powerful solutions available for building payment infrastructure in modern e-commerce and SaaS projects. Thanks to Stripe's comprehensive API, webhook system and advanced fraud protection, you can manage card payments, subscriptions and multi-currency transactions from a single platform. In this guide you will find every step needed to set up Stripe from scratch.
Stripe Account Setup and API Key Management
To begin a Stripe integration, you first need to create an account at stripe.com. Once the account is approved, you have access to two types of API key through the Dashboard: the Publishable Key (used on the client side and can be shared openly) and the Secret Key (must only be used on the server side and kept strictly confidential). Separate key sets are available for the test and live environments; always use the test keys during development.
- Publishable Key: Used to initialise Stripe.js in your frontend JavaScript code; can be sent to the client safely.
- Secret Key: Used for server-side API calls; should be stored in a .env file and never added to the source code.
- Restricted Keys: Can be created to grant limited access to specific API operations; this is the recommended approach from a security standpoint.
- Webhook Signing Secret: Used to verify that incoming webhook events genuinely come from Stripe.
Setting Up a Payment Form with Stripe Elements and Stripe.js
Stripe offers two main approaches to building a payment form: customisable form components with Stripe.js, and Stripe Checkout, a fully hosted, ready-made payment page. Both are PCI-DSS compliant; card data is sent directly to Stripe's servers and never touches yours.
Custom Forms with Stripe Elements
Stripe Elements lets you build payment forms designed specifically for your brand. After defining a div in your HTML and creating a Stripe instance with JavaScript, you mount a CardElement or separate components (CardNumberElement, CardExpiryElement, CardCvcElement). When the user enters their card details, Stripe.js tokenises this data and generates a PaymentMethod ID. You send this ID to your server and complete the payment server-side. Elements provides theming support, RTL compatibility and mobile keyboard optimisation, delivering an excellent user experience.
Webhook Integration: Real-Time Event Handling
Stripe webhooks are HTTP POST requests that notify your server in real time when a payment is completed, a subscription is renewed or a payment fails. After defining your webhook endpoint in the Stripe Dashboard, you must verify incoming requests using the Stripe-Signature header. The most critical webhook events are: payment_intent.succeeded (payment successful), payment_intent.payment_failed (payment failed), invoice.paid (invoice paid) and customer.subscription.deleted (subscription cancelled). It is critically important that your webhook handling code is idempotent, meaning it does not create duplicates when it receives the same event more than once.
Subscription Payments with Stripe
The Stripe Billing module provides comprehensive infrastructure for SaaS products and subscription-based e-commerce. To set up a subscription system, you create Product, Price (pricing plan) and Customer objects in turn. A Subscription linking the customer to a Price is then created. Stripe automatically generates the invoices, attempts payment and applies retry logic (smart retries) to failed payments.
Multi-Currency and Using Stripe in Turkey
Stripe supports more than 135 currencies. The Turkish Lira (TRY) is among the supported currencies; however, as of 2022 Stripe does not open accounts directly for companies based in Turkey. For this reason, Turkish developers generally create accounts through an overseas legal entity or via Stripe Atlas. Alternatively, a common approach is to use İyzico or PayTR as the primary payment provider for the Turkish market while integrating Stripe for international transactions.
Fraud Protection with Stripe Radar
Stripe Radar is a machine-learning-based fraud detection system. It analyses every transaction in real time and assigns a risk score. Because Radar is trained on data from millions of businesses across the Stripe network, it produces far more accurate results than individual rule-based systems. With custom rules you can block specific card countries, add extra verification to high-value transactions or blacklist suspicious email patterns. With the Radar for Fraud Teams package you can track intervened and reviewed transactions through detailed reports.
- Block Rules: Automatically block transactions that meet specific conditions.
- Review Rules: Place suspicious transactions in a manual review queue.
- Allow Rules: Let transactions from trusted customers through without verification.
- 3DS Triggering: 3D Secure can be triggered automatically on transactions with a high risk score.
Test Environment Setup and Best Practices
Stripe provides a comprehensive set of test card numbers for the test environment. The card number 4242 4242 4242 4242 simulates a successful payment, while 4000 0000 0000 0002 is used to test a declined payment. Special test cards are available for scenarios that require 3DS. For an ideal integration, follow these best practices: never add the Secret Key to frontend code; always verify webhook signatures; eliminate the risk of duplication by using idempotency keys; display error messages in a user-friendly way; and use the current version of Stripe's SDK.
Frequently Asked Questions
How long does a Stripe integration take?
A simple one-off payment integration can be completed in 1-2 days by an experienced developer. A comprehensive integration that includes webhooks, subscriptions and advanced Radar rules typically takes 1-2 weeks. Remember to include test and staging environment setup in this timeframe.
What are Stripe's commission rates?
Stripe's standard rate is 2.9 percent plus 30 cents per transaction (in USD). Rates may vary for Turkish Lira transactions and in different countries. Custom pricing can be negotiated for high-volume businesses. An additional Billing fee applies to subscription payments.
Can Stripe be used from Turkey?
Stripe does not open accounts directly for companies in Turkey. However, an account can be created through an overseas legal entity (for example a US LLC or a UK Ltd) or through the Stripe Atlas programme. To accept payments from Turkey, a hybrid approach combined with domestic PSPs is recommended.
How do you test Stripe webhooks?
With the Stripe CLI tool you can forward webhook events to your local development environment. On the command line, the command stripe listen --forward-to localhost:3000/webhook forwards webhooks to your local endpoint, and the command stripe trigger payment_intent.succeeded sends a test event.
Conclusion
When configured correctly, a Stripe integration provides a secure, flexible and scalable payment infrastructure. Handling every detail meticulously, from API key management to webhook security and from the subscription system to fraud protection, makes a major difference in the long term in terms of both operational efficiency and customer satisfaction. Get in touch with Toserof Tech. for your e-commerce integration projects.
