Payments with Stripe

No store, so who takes the money?

When Hyper Shards is sold on Steam, Steam handles the payment. But our main home is our own website, where players install Hyper Shards as a PWA. No store is there to take the payment.

So the studio uses a payment provider: a company that safely takes card payments for websites and pays the money to the business. Ours is Stripe.

One card payment, step by step

• 1. Checkout pageThe player clicks "Buy" and goes to Stripe Checkout, Stripe's own payment page.
• 2. Card networkStripe sends the payment through the card network, such as Visa or Mastercard.
• 3. The bank decidesThe bank that issued the card checks it is real and has enough money, then says yes or no. All in seconds.
• 4. We unlockStripe sends our server a signed message called a webhook. Only then do we mark the game as owned in Firebase. The webhooks lesson shows how.
• 5. PayoutStripe keeps its fee and pays the rest into our business bank account.

Why we never touch card numbers

Card numbers are a favorite target for criminals. Anyone who stores or handles them must follow strict security rules called PCI DSS.

Stripe Checkout is a hosted page: the player types their card details on Stripe's page, not ours. The numbers never reach our servers or our Firebase database. Even if our site were attacked, there would be no card numbers to steal. Stripe does the hard security work, which is a big reason studios use it.

Two keys and a Checkout Session

Stripe gives us two kinds of API key, secret codes that prove a request comes from our studio:

• The publishable key (starts with pk_) is safe to put in browser code.
• The secret key (starts with sk_) can create charges and refunds, so it lives only on our server, like a Firebase Cloud Function.

When a player clicks Buy, our server uses the secret key to create a Checkout Session: the item, the price and the player's Firebase user id. Stripe replies with a link to its payment page. In test mode, the test card 4242 4242 4242 4242 runs on pretend money.

Fees and payouts

At the time of writing, Stripe's standard fee for US cards is about 2.9% + 30 cents per payment. Fees vary by country, so check the latest.

The 30 cents is fixed, so small payments lose a bigger share. On a $1 sale the fee is about 33 cents, a third of the price. On $10 it is 59 cents.

Stripe pays the rest into our business bank account. The very first payout can take one to two weeks while Stripe checks the new account. After that, payouts arrive on a regular schedule, usually a few days after each payment.

Who opens it, and where it works

A Stripe account is a legal contract, and laws require Stripe to check the identity of everyone it pays, to stop fraud and money laundering. So an adult opens it: you and a parent set it up together, connected to the company's tax number and business bank account.

Stripe is for our website. Most phone games use the store's own payment window for digital items. In some places, like the US and Europe, apps may now also link to a web shop, but the rules are still changing, so check the latest.

Bolt says: Next lesson: webhooks, how our server knows for certain that a player paid.