Mantenha o contrato Stripe. Troque o routing.

Payment Intents via XPayments e Stripe.js / Payment Element no browser. A Store resolve routing e GatewayVault; o fluxo de cartão já foi certificado em TEST e LIVE.

Stripe-compatible Direct API

TEST + LIVE E2E CERTIFIED

Compatibilidade para projetos baseados em Stripe v1 Payment Intents. O request continua form-encoded, a autenticação server-side usa uma chave XPayments da Store e o routing segue a configuração ProviderAccount → ProviderConnection → GatewayVault. O fluxo de cartão foi validado end-to-end em TEST e num pagamento LIVE controlado, incluindo webhook Stripe verificado, Finance Core e WalletMovement.

Server key

xp_test_* / xp_live_*. Store-scoped e nunca exposta no browser.

Stripe Elements

Stripe.js usa a pk_* pública da Store e o client_secret do PaymentIntent.

Gateway isolation

sk_*, rk_* e provider webhook secrets permanecem no GatewayVault XPayments.

Fluxo certificado

Create PaymentIntent → Transaction XPayments → nexflowx_transaction_id → confirmação Stripe.js → webhook Stripe verificado → Transaction succeeded → fee/net → WalletMovement exatamente uma vez. Retries do create usam Idempotency-Key estável.

Métodos de pagamento

Para Payment Element com cobertura ampla, prefira automatic_payment_methods[enabled]=true. A lista real é dinâmica e depende da Store, conta Stripe, moeda, país, capabilities, valor e contexto do comprador. Não trate a lista de um PaymentIntent como garantia estática da plataforma.

Stripe original referência

bash

curl https://api.stripe.com/v1/payment_intents \
  -u "sk_test_xxxxxxxxx:" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Idempotency-Key: order-12345-payment-1" \
  --data-urlencode "amount=2500" \
  --data-urlencode "currency=eur" \
  --data-urlencode "automatic_payment_methods[enabled]=true" \
  --data-urlencode "metadata[merchant_reference]=order-12345"

XPayments Stripe-compatible

bash

curl https://api.xpayments.digital/api/stripe/v1/payment_intents \
  -u "xp_test_xxxxxxxxx:" \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -H "Idempotency-Key: order-12345-payment-1" \
  --data-urlencode "amount=2500" \
  --data-urlencode "currency=eur" \
  --data-urlencode "automatic_payment_methods[enabled]=true" \
  --data-urlencode "metadata[merchant_reference]=order-12345"

PaymentIntent endpoints

POST /api/stripe/v1/payment_intentsGET /api/stripe/v1/payment_intents/:idPOST /api/stripe/v1/payment_intents/:idPOST /api/stripe/v1/payment_intents/:id/confirmPOST /api/stripe/v1/payment_intents/:id/cancelPOST /api/stripe/v1/payment_intents/:id/capture

Payment Element no frontend do Merchant

O backend cria o PaymentIntent através de XPayments. O browser usa Stripe.js com a publishable key pk_* disponibilizada para a Store. Nunca envie PAN/CVV ao backend XPayments.

javascript

// Server: create the PaymentIntent through XPayments.
const body = new URLSearchParams();
body.set("amount", "2500");
body.set("currency", "eur");
body.set("automatic_payment_methods[enabled]", "true");
body.set("metadata[merchant_reference]", "order-12345");

const response = await fetch(
  "https://api.xpayments.digital/api/stripe/v1/payment_intents",
  {
    method: "POST",
    headers: {
      Authorization: "Bearer xp_test_xxxxxxxxx",
      "Content-Type": "application/x-www-form-urlencoded",
      "Idempotency-Key": "order-12345-payment-1"
    },
    body
  }
);

if (!response.ok) throw new Error("XPAYMENTS_PAYMENT_INTENT_CREATE_FAILED");
const intent = await response.json();

// Persist intent.id + intent.metadata.nexflowx_transaction_id server-side.

// Browser: Stripe.js uses only the Store's browser-safe pk_*.
const stripe = Stripe("pk_test_xxxxxxxxx");
const elements = stripe.elements({ clientSecret: intent.client_secret });
const paymentElement = elements.create("payment");
paymentElement.mount("#payment-element");

Finalidade e Merchant webhook

Redirect, return_url e estado observado no browser são UX. Finalize o Order a partir do estado XPayments/webhook Merchant. O contrato normalizado usa x-nexflowx-signature com HMAC-SHA256 sobre o raw body. A XPayments não promete um outbound Stripe Event completo.

Qual integração escolher?

Modelo	Frontend	Credencial browser	Provider visível	Uso recomendado
Checkout XPay	Hosted / Embedded	Nenhuma	Não	Provider-neutral
Native S2S	Merchant-owned	Depende do método	Não	PIX/local actions
Stripe-compatible + Elements	Stripe Payment Element	`pk_*`	Sim	Stripe-style integration