Leyla puts a book that costs 25 AZN into her cart, presses "Pay", types in her card details — and a second later sees "Payment successful". In that second the request visited six parties, and the real money has not even moved yet. We will look at the path of a payment, why the card number must never pass through your server, how "freezing" an amount differs from charging it, why 3-D Secure and PCI DSS exist, and how to avoid charging money twice. Stripe code starts in the next lesson.
Why you cannot just build a card form
The naive idea: "A field for the card number, sent to my server — and I will somehow charge the money." In reality, "somehow" is a contract with a bank that accepts cards from shops (acquiring), a connection to Visa and Mastercard, fraud protection, 3-D Secure and the PCI DSS standard, because card numbers would pass through your server. For a small team that means months of work and a big risk.
That is why shops connect a payment provider: you call its API, it talks to the banks, and the customer enters the card on its protected page. It is like renting a unit in a ready-made shopping mall: the terminal, security and accounting are already there. Stripe is one of the best-known providers, but the principles are the same everywhere.
Who takes part in a payment
A card payment has six participants, not two:
| Participant | Who it is | What it does |
|---|---|---|
| Buyer (cardholder) | Leyla | enters the card, confirms the payment |
| Merchant (the shop) | you and your server | creates the payment, hands over the goods |
| Payment provider (gateway) | Stripe | accepts the shop's request, talks to the banks |
| Acquirer bank | the shop's bank | accepts payments and transfers the money to the shop |
| Card network | Visa, Mastercard | the network between banks: messages and settlement |
| Issuer bank | the bank that issued Leyla's card | checks the balance and the risk, approves or declines |
The authorization request travels right to the issuer, the answer "approved" or "declined" comes back left — usually within a second. The key idea: you talk only to the provider, and it does everything to its right for you. "Gateway", "processing" and "PSP" are close roles: today one provider usually plays all three. The fee is split between the participants and depends on the country, the card and the pricing plan.
Authorization and capture: like a hotel
When you check in at a hotel, an amount is "frozen" on your card, and the real charge comes when you leave. Online card payments work the same way, with two steps:
- Authorization. The issuer checks the card, the balance and the risk (sometimes it asks for 3-D Secure) and reserves the amount: the money is still the customer's, but they cannot spend it.
- Capture. The shop confirms the final amount, and the reservation becomes a final payment.
Then the banks reconcile their registers (clearing) and move the money (settlement): through the card network to the acquirer and then to you. It takes days, so "payment succeeded" and "the money is in your account" are different events.
