Payment Gateways 💳

<?php
// Create a Stripe Checkout Session, then redirect the customer to Stripe.
// Install once:  composer require stripe/stripe-php
require_once "vendor/autoload.php";

use Stripe\\StripeClient;

// Your SECRET key lives ONLY on the server, loaded from an env variable —
// never hard-code it and never send it to the browser.
$stripe = new StripeClient(getenv("STRIPE_SECRET_KEY"));

// You set the price on the SERVER. Never trust an amount sent by the browser.
$session = $stripe->checkout->sessions->create([
    "mode" => "payment",
    "line_items" => [[
        "quantity" => 1,
        "price_data" => [
            "currency"     => "usd",
            "unit_amount"  => 4900,                 // 4900 = $49.00 (amounts are in CENTS)
            "product_data" => ["name" => "Pro Plan"],
        ],
    ]],
    "success_url" => "https://myapp.com/success?session_id={CHECKOUT_SESSION_ID}",
    "cancel_url"  => "https://myapp.com/cancel",
]);

echo "Session created: " . $session->id . "\n";   // e.g. cs_test_a1B2c3...
echo "Redirect URL:   " . $session->url . "\n";    // Stripe's hosted, secure page

// In a real app you redirect the browser to that URL:
//   header("Location: " . $session->url, true, 303);
//   exit;
?>

Session created: cs_test_a1B2c3D4e5F6
Redirect URL:   https://checkout.stripe.com/c/pay/cs_test_a1B2c3...

<?php
// Webhook endpoint (webhook.php). Stripe POSTs here server-to-server AFTER the
// payment, even if the customer closes the browser. THIS is where you fulfil.
require_once "vendor/autoload.php";

use Stripe\\Webhook;
use Stripe\\Exception\\SignatureVerificationException;

$payload   = file_get_contents("php://input");          // raw request body
$signature = $_SERVER["HTTP_STRIPE_SIGNATURE"] ?? "";   // the Stripe-Signature header

try {
    // Verify the signature so you KNOW the event really came from Stripe.
    $event = Webhook::constructEvent(
        $payload,
        $signature,
        getenv("STRIPE_WEBHOOK_SECRET")
    );
} catch (SignatureVerificationException $e) {
    http_response_code(400);          // 400 = reject a forged or tampered request
    exit("Invalid signature");
}

// Fulfil ONLY when Stripe says the money cleared.
if ($event->type === "checkout.session.completed") {
    $session = $event->data->object;
    echo "Paid! Fulfilling order for " . $session->customer_email . "\n";
    // markOrderPaid($session->id);  sendConfirmationEmail($session->customer_email);
}

http_response_code(200);   // 200 tells Stripe "got it" so it stops retrying
?>

Paid! Fulfilling order for alice@example.com

<?php
// Refund a charge from the server. The "idempotency key" makes a retry safe:
// send the same key twice and Stripe refunds ONCE, not twice.
require_once "vendor/autoload.php";

use Stripe\\StripeClient;

$stripe = new StripeClient(getenv("STRIPE_SECRET_KEY"));

$refund = $stripe->refunds->create(
    ["payment_intent" => "pi_3Nxyz...", "amount" => 4900], // full $49.00 refund
    ["idempotency_key" => "refund-order-1234"]             // safe to retry
);

echo "Refund status: " . $refund->status . "\n";   // succeeded / pending / failed
echo "Refunded:      $" . ($refund->amount / 100) . "\n";
?>

Refund status: succeeded
Refunded:      $49

<?php
// 🎯 YOUR TURN — set the price on the SERVER (never trust the browser).
// Stripe amounts are in CENTS, so multiply whole dollars by 100.
require_once "vendor/autoload.php";
use Stripe\\StripeClient;

$stripe = new StripeClient(getenv("STRIPE_SECRET_KEY"));

$priceInCents = ___;   // 👉 a $25.00 item, in cents (25 * 100)

$session = $stripe->checkout->sessions->create([
    "mode" => "payment",
    "line_items" => [[
        "quantity" => 1,
        "price_data" => [
            "currency"     => "usd",
            "unit_amount"  => $priceInCents,
            "product_data" => ["name" => "E-book"],
        ],
    ]],
    "success_url" => "https://myapp.com/success",
    "cancel_url"  => "https://myapp.com/cancel",
]);

echo "Charging " . ($priceInCents / 100) . " dollars\n";

// ✅ Expected output:
//    Charging 25 dollars
?>

Charging 25 dollars

<?php
// 🎯 YOUR TURN — finish the webhook so it ONLY fulfils a verified event.
// Fill the blank so a bad signature is rejected with a 400 status.
require_once "vendor/autoload.php";
use Stripe\\Webhook;
use Stripe\\Exception\\SignatureVerificationException;

$payload   = file_get_contents("php://input");
$signature = $_SERVER["HTTP_STRIPE_SIGNATURE"] ?? "";

try {
    $event = Webhook::constructEvent($payload, $signature, getenv("STRIPE_WEBHOOK_SECRET"));
} catch (SignatureVerificationException $e) {
    http_response_code(___);        // 👉 the HTTP code that means "Bad Request"
    exit("Invalid signature");
}

echo "Verified event: " . $event->type . "\n";
http_response_code(200);

// ✅ Expected output (for a genuine event):
//    Verified event: checkout.session.completed
?>

Verified event: checkout.session.completed