Search code examples
apistripe-paymentspci-dss

Stripe retrive customer API also retrives card info (PCI ompliance)


I created customer in Stripe with Elements. Now I need to check if customer exists in my web app (with axios request). As far as I know the only way to check if customer exists is to retrive him: https://stripe.com/docs/api/customers/retrieve.

I don't want customer's card information to be present in my app because of PCI compliance. But https://stripe.com/docs/api/customers/retrieve API gives card information in response. Is there any method which checks customer's status? Thank you!


Solution

  • If you use the stripe provided card collection functionality then the actual card details will not be sent to your server instead stripe handles it and then provide you a token which we cannot reverse to all card details. After that all the data stripe api is returning can be stored on your server. Since it doesn't contain any credentials which can be used to charge the card without Secret key stored in your server. https://stripe.com/docs/security

    Regarding what data you want to show on your front end:

    When you are sending request to your server from front end (and server checks customer with stripe api), in response from your server you can omit any information which you don't want to send to your front end. So essentially what you will be doing is that only restrict user to only their customer data you have on your server.