In short, yes—confirmation is requried.
Here's an example of a payment link: https://buy.stripe.com/dR6cOd9RJ8KS8nufYZ. It's a single link that can be shared with anybody (not unique to one customer).
On the Stripe side, nothing is collected from the customer til they click.
We've thought a lot about the security side of things—one of the reasons why Payment Links has its own subdomain and the payment page is hosted by Stripe.
Very cool. One quick thought: tapping the company name doesn’t seem to do anything at the moment.
It would be very cool if it would either (1) redirect to the company website or (2) a “store” or directory showing other available Payment Links.
Excellent work!
Aha! Thanks. Great ideas.
Re:Stripe Payment Links
by CallMeMarc on Tuesday May 25, 2021 @07:04PM
(#27283897)
I don’t know what I expected but I guess I have a new sticker for my MacBook now.
Really nice and clean process though.
The link itself is global, not local to a transaction. So I can have the same link posted on my Github repo to support development or in my HN bio to buy me a coffee. That link then generates a checkout session when you visit it, and if the payment is actually made, then I see a payment entry in my dashboard. But the link is just a common global initiator.
I'm curious if you have analytics collection on the first use case since it seems like a pretty risky privacy violation in terms of user tracking but honestly not far beyond shenanigans that bigger players pull (Facebook/Amazon).
But I'm really curious about the second use case - the no code approach is really nice and flexible for sending payment requests over alternative media (i.e. discord) but it feels like this might open the door a bit more to phishing users via redirection - do you happen to have any security ruminations on that topic that you've made public or be willing to share?