CODEWITHSUNDEEP
node.jssails.jsstripe-payments
WagnerMatosUK
WagnerMatosUK

Reputation: 4429

What is the most secure way to implement Stripe in a Node application which the user can add the publishable and secret in a settings panel

Requirement: The nodejs (Sails) application needs an interface (settings page) so the user can add both publishable and secret keys after they have created their account on Stripe.

My thoughts on how to do it: Have a settings page and once the user enters both keys, the application will write the secret key to a file. The controller that requires the secret key will then load the file and use it.

For the publishable key, once the user adds it in the settings page, the application saves it to the db, and on my html file I can query the db via ajax call and retrieve the publishable key and assign it to a js variable.

My question: is this good practice in terms of security?

Any suggestions on how to improve it?

Many thanks

Upvotes: 1

Views: 535

Answers (1)

Pete Keen
Pete Keen

Reputation: 1021

Is this a hosted application? If so, you can use Stripe Connect to get keys specific to your application. They never have to share anything with you, they just go through the OAuth flow and at the end you have a publishable key and a secret key that you can use to make charges on their behalf.

If this is an installable application I would encourage you to keep both keys in environment variables instead of the database or files.

Upvotes: 1

Related Questions