How To: Set up your Stripe account for Blomstra Payments

luceos

This guide will help you set up your Stripe account by explaining the different Stripe products, prices and what to copy where. It is important that your Stripe account is production-ready, meaning it is created and approved. This usually requires you to fill out a lot of legal and fiscal information. As this is part of the Stripe onboarding I will not go into this.

Configure Blomstra Payments

Visit the "Developer" by clicking the option on the top right navigation bar. Click on "API keys" on the left hand menu. Copy the "Publishable key" and "Secret key" to the Blomstra Payments settings page of your community. Save these settings.

Next click on "Webhooks" in the "Developers" page in Stripe, then on "Add endpoint" and on the form:

Endpoint URL: https://yoursite.com/api/blomstra-payments/stripe/webhook
Description: Blomstra Payments webhooks for Your Site.
If you have the choice: Listen to Events on your account.
Version: 2022-08-01 or Latest.

Product

On your dashboard, go to Products and click "add product". You will notice a form pops up that allows you to configure a name, description and image among others. Fill out these details for the Blomstra Payments type you want to add, for instance for bounties you could simply name it "Bounty" or "Pledge" and then describe it what the pledge is used for.

The next heading is called "Price information" this is the most crucial part of configuring your product. The following Pricing models are relevant to us:

Standard pricing for one time and recurring payments.
Customer chooses price where the user specifies exactly how much this wish to pay.

For the Bounties Payment type you need to choose the "Customer chooses price", for all other Payment types of this extension, you need to select Standard pricing. Fill out the fields to your liking. Some pointers:

Currencies are taken into account.
For standard pricing Metered usage is ignored.
Trials are possible.
Don't go crazy on the amount of options as the screen space is limited.

To copy the product ID needed by Blomstra Payments, visit the Product detail page and click the prod_ id on the top right or click ctrl + i. You can then use this product ID in one of the tags or permission groups based on the Blomstra Payment Type, see: https://discuss.flarum.org/d/26095-payments-monetize-your-community.

vlad

luceos We already have Stripe and use a WebHook for handling payments on kagi?

is there a way to set this webhook to receive only events associated with the activity on the forum. Please advise what is the suggsted way of handling this?

luceos

vlad is there a way to set this webhook to receive only events associated with the activity on the forum. Please advise what is the suggsted way of handling this?

The payments extension adds meta information to each transaction it initiates with Stripe. As a result, the extension will filter any webhook event from Stripe based on that meta information. One of the things it matches on is the forum URL, another is the Blomstra Payments type. If some of the meta information isn't available, it will simply ignore them.

I have no information how the other script works, but I assume it needs to connect data stored from the pre-authorization with the confirmation as well.

As such, I think it should be safe to configure this second webhook endpoint, at least from a perspective of the extension I can guarantee nothing will misbehave.

vlad

luceos It sounds it is a pretty big security and privacy risk to transfer personal and billing information of thousands of Kagi search customers to an unrelated forum site through an open-ended webhook. I am pretty sure that would not be at least GDPR compliant ?

I find it hard to believe that other users of the extension are doing that? I would expect that there is at least some setting on Stripe side to send only relevant webhooks (for a particular product for example) to a given webhook?

luceos

vlad an unrelated forum site through an open-ended webhook

The webhook endpoint is protected, the extension supports using a webhook signing key to confirm the endpoint on the forum. Also, the forum isn't unrelated, you are still the same party right? If not, then perhaps you should create a new Stripe account. That would also be a solution to separate the data between those two platforms. I have several accounts at Stripe, for different projects.

vlad I find it hard to believe that other users of the extension are doing that? I would expect that there is at least some setting on Stripe side to send only relevant webhooks (for a particular product for example) to a given webhook?

The extension discards any information not intended for the running community. I've also looked into the Stripe settings and found nothing that would allow separating data for specific products or clients.