Online payments: how they work and which service to choose

import Stripe from 'stripe';

export const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);

// The amount comes from the order on the server, never from the browser
export async function createCheckout(order) {
  const session = await stripe.checkout.sessions.create({
    mode: 'payment',
    line_items: [{
      price_data: {
        currency: 'usd',
        product_data: { name: order.title },
        unit_amount: order.totalCents,          // $320.00 = 32000
      },
      quantity: 1,
    }],
    metadata: { order_id: String(order.id) },
    success_url: `https://example.com/orders/${order.id}?paid=check`,
    cancel_url: 'https://example.com/cart',
  });

  return session.url;                           // send the buyer here
}

import express from 'express';
import { stripe } from './payment.js';

const app = express();

// The raw body is required to verify the signature
app.post('/webhooks/stripe', express.raw({ type: 'application/json' }), async (req, res) => {
  let event;
  try {
    event = stripe.webhooks.constructEvent(
      req.body,
      req.headers['stripe-signature'],
      process.env.STRIPE_WEBHOOK_SECRET,
    );
  } catch (err) {
    return res.status(400).send(`Webhook error: ${err.message}`);
  }

  if (event.type === 'checkout.session.completed') {
    const session = event.data.object;
    await markOrderPaid(session.metadata.order_id);   // safe to run twice
  }

  res.json({ received: true });
});