I'm trying to use Stripe for payments in my rails app. I remember at one internship I had, we used the active merchant
gem to abstract the process by using gateways. Although, at the internship, we used Authorize.net. We didn't use Stripe. For this particular application, I would like to use Stripe and ActiveMerchant together.
Looking at the documentation on the Active Merchant GitHub page, I found that I could connect to Stripe using the StripeGateway provided by the Active Merchant gem. This is how I did it:
ActiveMerchant::Billing::Base.mode = :test
# Create a new credit card object
credit_card = ActiveMerchant::Billing::CreditCard.new(
:number => '4242424242424242',
:month => '8',
:year => '2022',
:first_name => 'Tobias',
:last_name => 'Luetke',
:verification_value => '123'
)
if credit_card.valid?
gateway = ActiveMerchant::Billing::StripeGateway.new(
login: Rails.application.credentials.development[:stripe_private_key]
)
# Authorize for $10 dollars (1000 cents)
response = gateway.authorize(1000, credit_card)
if response.success?
# Capture the money
gateway.capture(1000, response.authorization)
else
raise StandardError, response.message
end
end
However, this is a problem. Whenever I run this, I get a strange error:
StandardError (Sending credit card numbers directly to the Stripe API is generally unsafe. We suggest you use test tokens that map to the test card you are using, see https://stripe.com/docs/testing.)
I understand that this is a security issue, but I don't understand how to ago about fixing it using Active Merchant. I tried using Stripe's documentation for ruby on rails, but the form was very simple. It only had a credit card number, expiration data, and CVC entry, as well as email. But i need a billing address as well. This is my reasoning for using Active Merchant. It's very simple to use and abstracts a lot of the fluff out while still being able to create custom forms. But, I keep getting this error here with Stripe, and I don't know how to fix it.
Any help is appreciated!
Using the Stripe gateway, ActiveMerchant's purchase
and authorize
methods should take either a card object, as you are passing above, or a token value (a string)
# purchase(money, card_hash_or_token, { ... })
Instead of passing raw card details, for PCI compliance reasons, you could create a token on your client-side using Stripe's Checkout or Elements libraries, pass the source/token id to your backend (it should look like tok_xxxyyyzzz or src_xxxyyyyz), and then pass that value into the second card_hash_or_token
parameter of your authorize request.
response = gateway.authorize(1000, params[:stripeToken])