https://stripe.com/de

MARCH 2018

Installation & Configuration Manual for Magento 2

Magento 2 Extensions By Stripe

Contents

1. • Creditcard -Takes card details

   • Instant checkout – Support only HTTPS server

   • Currencies Applicable For: Determines whether the payment method will be available to the customer at the checkout based on the currency in which their order is placed. All of the

payment methods will only work with the Euro (€) currency, however this setting is by default to

“All Currencies” so that the payment method can be tested when initially set up. You can switch this to “Euro Only” on your live website.

2. Security Best Practices

Figure 3: security sybmol

All eCommerce sites are attractive targets to hackers because of the personal and payment

information that is required to complete a sale. Even if the system does not directly process credit card transactions, a compromised site might reroute customers to a false page, or alter an order before it is transmitted to the payment processor.

A compromised site can have long-term consequences for both customers and merchants.

Customers might suffer financial loss and identify theft, while merchants can face damage to their reputations, loss of merchandise, higher processing fees, revoked privileges with financial

institutions, and the threat of lawsuits.

This guide outlines a multifaceted approach to improve the security of your Magento installation. Although there is no single way to eliminate all security risks, there are many things that you can do to make your site a less attractive target. It is crucial for hosting providers, system integrators, and merchants to work together to establish and maintain a secure environment, implement methods for

early detection, and determine a plan of action in the event of a breach

—Should encompass that SSL certificate is required

What is SSL?

First things first — what is SSL, exactly? “SSL” is short for “Secure Sockets Layer “. In simpler terms, it’s how small business communicate with customers that they can browse, buy products or services, and share information safely with you online. Without getting overly technical, adding an SSL creates a safe connection for those kinds of activities.

Think of an SSL certificate as a giant windshield for when you drive on the information super-highway. You wouldn’t head out on your local freeway — especially at night in a rural

area — without something between you and all the bugs. You likely couldn’t see, and besides, you’ve already had your protein for breakfast. In much the same way, an SSL certificate

protects your site — and its visitors — from many digital bugs, worms and other nasty web creatures.Before quickly dismissing your site as “too small to be a target,” bear in mind that most interceptions are done electronically without a human deciding who is attacked.

How SSL works?

If you’re ever wondered how SSL works, look no further. An SSL certificate works to create an encrypted connection between your visitor’s browser and the server. A secure session is established via a “handshake” process, one that involves a back-and-forth between the web browser and the web server, and it occurs behind the scenes — all without interrupting the shopping or browsing experience.

Remember, anything that needs to be secure online needs to operate under the safety net of an SSL certificate.

*SSL Certificate Required for Stripe Extension

—Pages need to be served via HTTPS

HTTPS is important for an information you want encrypted over the site. Not everything needs to be encrypted over the site and the additional overhead of the process of encryption and decryption may be overkill for your site.https://docs.woocommerce.com/document/stripe/?_ga=2.33715361.1871479095. 1522171639-1902166320.1495470402#section-15

If 

you have a page within your site that takes personal information such as credit card numbers, passwords, ssn#’s etc then this information should be encrypted.

Figure 4: SSL/https inviroment

*HTTPS Required for Over All Payment Pages of Stripe

–Admin url

After get SSL certification at site and set HTTPS from admin configuration for both URL secure and unsecure .

https://www.domain.com/AdminUrl

Login Admin panel and identify “Stores-> Setting (Configuration) ” and Go to General->web

Section.

Find Base URLs and Base URLs (Secure).

Set URL with HTTPS.

Figure 5: Set HTTPS url in admin panel

–Link to Magento Security best practises

Here Is link to get best appeariance to Magento Security Best Practises https://magento.com/security/best-practices/security-best-practices https://www.appseconnect.com/magento-security-best-practices/

–Update best practices / instructions

Here is link to get latest best practises done by

https://magento.com/security/news

–Payment Method Guide:

https://stripe.com/payments/payment-methods-guide

3. Installation

–>Upload Files to Site via FTP

You can use SSH to install the files on your server, but FTP offers a nice user interface and

feedback for an easy method to install your module files. The FTP/SSH method of installation is required if the module is not on the Magento Marketplace.

1. –Download and extract the Stripe module.

2. –Ensure you have a FTP program installed such as Filezilla.

3. –Open your FTP program.

4. –Connect to your server.

Figure 6: Connect to server

5. On the remote side navigate to the root of your Magento installation.

*Note – You should see folders such as “app”, “vendor”, and “pub” in your Magento root if Magento has already been installed on the server.

Figure 7: Remote site Magento root

5. On the local site navigate to the folder you have extracted the module into.

Figure 8: Local site extracted module directory

5. Now right-click on the “app/code/Stripe” directory on local site, and select “Upload”.

Figure 9: Right-click and select Upload

8 -Ensure there are no “Failed Transfers”. If there are, it could mean your connection with the server was interrupted,

so simply try to upload the files again. Another reason for a failed transfer is if the permissions on your server are not allowing you to upload a file, in which case you would need to contact your

hosting company to assist.

Now that the files are uploaded we can navigate to the connected ssh terminal use some to complete installation.

Enable the module by running the following commands:

php bin/magento setup:upgrade php bin/magento cache:flush

If you are running Magento in production mode, you will also need to run:

php bin/magento setup:static-content:deploy php bin/magento setup:di:compile

4. Configurations

   1. Stripe – Hosted Configuration (Webhook Configuration)

Here Is Url to set Webhook https://dashboard.stripe.com/account/webhooks

Because most of the payment methods redirect the customer away from the merchant’s website, there must be a way to know whether a payment authorization has succeeded or failed. This is

important because some customers never return to the merchant’s website after they authorize the payment with their bank (simply because they don’t think it is necessary).

To alleviate the problem, Stripe provides an event emission mechanism called Stripe Webhooks which can notify the merchant’s website when a payment has been authorized, failed or canceled by the customer. To enable Stripe Webhooks, go to your Stripe dashboard and under API > Webhooks, add the module’s webhooks endpoint as shown in the following screenshot.

Figure 10: Create Endpoint in stripe dashboard

URL to be called: https://www.domain.com/stripe/webhook. If you have multi-store views configured with different URLs, then you must pick one of those URLs for the webhooks. For example if you have a store view at https://www.domain.com/, then the webhook URL will be https://www.domain.com/stripe/webhook. You only need to configure one webhook for your entire site.

• Events to send: You will need to create 2 separate endpoints, one for your live website and one for your testing environment

• Webhook version: You can use either your current one or upgrade to the latest. If you are concerned about backwards compatibility, you can check https://stripe.com/docs/upgrades for the green “MAJOR” tags in the version upgrades.

• Filter event: Only 5 events are currently supported by the module –

• source.canceled

• source.chargeable

• source.failed

• charge.succeeded

• charge.failed

•  
•  
• We recommend to only enable these 5 to avoid flooding your website with unnecessary requests, and so that you keep clean logs in Stripe which you can easily debug if necessary.

Once configured, your webhook endpoint will appear in Stripe like so.

Figure 11: After Create Endpoint in stripe dashboard

4. 2. Stripe – Core module Configuation

Log into the backend of your Magento Admin Panel.

4. 1. 1. Input your admin username.

      2. Input your admin password.

      3. Click “Sign-In” button to login to your magento admin panel.

Figure 12: Magento Admin Login Panel

4. 1. 4. Navigate to Stores > Configuration.

Figure 13: System > Configuration

4. 1. 5. Identify the “Sales” section in left navigation.

4. 1. 6. Identify the “Payment Methods” in Sales section, and select it.

Figure 14: Sales > Payment Methods

4. 1. 7. Expand the section of any payment method you need to configure as shown in the following screenshot:

Figure 15: Stripe core module configuration

4. 1. 8. dentify the “Sandbox Mode” drop down field, single click the arrow to right of field, and select preferred option.

*Note – Choose either “Sandbox” or “Production” depending on what site you are testing.

Sandbox yes is for testing purposes, and Production is for when you are ready to start making live purchases.

4. 1. 9. Identify the “production/sandbox publishable api” text field, and input your API user name assigned to you by Stripe. If you do not have an API key, create an account on Stripe or contact Stripe merchant support.

After create account you can get from Stripe dashboard.In Left section There API keys option under Developers Tab.Copy and paste Api keys their field

*Note – This is the first part of the Publishable API Key, before colon.

4. 1. 10. Identify the “production/sandbox secret api” text field, and input your API assigned to you by Stripe.

For Secret Keys See above Point and ScreenShot

*Note – This is the second part of the Secret API Key, after colon.

4. 1. 11. Identify the “Debug” dropdown field, single click the arrow to right of field and select preferred option.

*Note – Select “Yes” during development. For production, ensure debug is disabled.

4. 1. 12. Currencies Applicable For: Determines whether the payment method will be available to the customer at the checkout based on the currency in which their order is placed. All of the payment methods will only work with the Euro (€) currency, however this setting is by default to “All

Currencies” so that the payment method can be tested when initially set up. You can switch this to “Euro Only” on your live website.

4. 3. Stripe – Payment module Configuation

—> Sofort,Bancontact,GiroPay,P24,Ideal,Alipay

After Login Admin dashboard.

For Sofort,Bnacontact,Giropay,P24,Ideal all configuration same.So See One payment method configuration and do as same for all that mention

1. Go to System > Configuration >sales-> Payment Methods

2. Expand the section of any payment method you need to configure as shown in the following screenshot.

Figure 16:Stripe SOFORT module configuration (same as for IDEAL,ALIPAY,BANCONTACT,GIROPAY,P24)

1. Enabled: Enable or disable the payment method.

2. Title: This is the name of the payment method as it will be seen by the customer at the checkout page.

3. Sort Order: If you have many payment methods enabled, this setting will determine the order of this payment method at the checkout page. This is a global sort order that can be set for any

payment method, including PayPal and the original Stripe Payments.

—> Sepa Direct Debit

After Login Admin dashboard.

1. Go to System > Configuration >sales-> Payment Methods

2. Expand the section of any payment method you need to configure as shown in the following screenshot.

Figure 17: Stripe sepa configuration

1. Enabled: Enable or disable the payment method.

2. Title: This is the name of the payment method as it will be seen by the customer at the checkout page.

3. Payment From Applicable Countries: Determines whether the payment method will be

available to the customer at the checkout based on the country they set in their billing address. You can select “All Allowed Countries” if you want to show the payment method for all countries. An appropriate error message will be displayed at the final checkout step if the customer’s country is

not supported.

4. Payment From Specific Countries: Each payment method is only available in specific countries. The supported countries of each payment method are pre-selected by default based on Stripe’s

documentation. We do not recommend changing this setting unless a new supported country is announced by Stripe.

4. Payment Display Text For Payment Transaction: This is an optional small description of the source of the payment which will be shown in the checkout page statements.

4. Sort Order: If you have many payment methods enabled, this setting will determine the order of this payment method at the checkout page. This is a global sort order that can be set for any

payment method, including PayPal and the original Stripe Payments.

—> Credit card

*Https Required for Credit card Payment

Figure 18: Stripe Credit card configuration

Figure 19: Stripe credit card configuration

1. Enabled: Enable or disable the payment method.

2. Enforce 3D Secure :3D Secure (3-domain secure), also known as Payer Authentication is a security protocol to prevent fraud in transactions with credit and debit cards online. Currently, this service is provided by Visa and MasterCard under the name Verified by Visa and MasterCard SecureCode, respectively.

It also makes shopping/commerce safer online, nourishes brand loyalty, it is easy to use, customer confidence improves on websites and therefore increases spending online.

3. Title: This is the name of the payment method as it will be seen by the customer at the checkout page

4. Credit card Types: Identify the “Credit Card Types” multi select field, and select preferred

option. To select multiple options hold the Ctrl button and select your preferred options. Whatever cards are selected will be the only credit cards accepted for Stripe on the front end of the site.

5. Transaction Action : Identify the “Transaction Action” drop down field, single click the arrow to right of field and select preferred option.

*Note – Choose either “Authorize Only” or “Authorize and Capture”. Authorize Only will not create an invoice for the order on order placement. Authorize and Capture will create an invoice for the order on order placement.

6. Payment From Applicable Countries: Determines whether the payment method will be

available to the customer at the checkout based on the country they set in their billing address. You can select “All Allowed Countries” if you want to show the payment method for all countries. An

appropriate error message will be displayed at the final checkout step if the customer’s country is not supported.

7. Payment from Specific Countries: Each payment method is only available in specific countries.

The supported countries of each payment method are pre-selected by default based on Stripe’s documentation. We do not recommend changing this setting unless a new supported country is announced by Stripe.

8. Ajax Timeout:This is used when customer return from 3ds page.

9. Sort Order: If you have many payment methods enabled, this setting will determine the order of this payment method at the checkout page. This is a global sort order that can be set for any

payment method, including PayPal and the original Stripe Payments.

—> Instant checkout (Apple Pay And Google Pay)

*Https Required for Instant Checkout

Apple Pay

Before you start using Apple Pay, you must accept the Terms of Service in your Stripe dashboard:

After this, you will then need to follow Stripe’s guide to verifying your domain with Apple Pay.

Customers will need to have a payment method from a supported bank or payment card provider, please see the Apple Pay support page for more details.

Google Pay

Make sure that the Payment Request Buttons option is enabled, there is no other setup for you to accept payments via this method.

Note: the Google Pay button on mobile devices will only show when there is a saved payment card, and with all the permissions (Location is optional) allowed for Google Play services.

Customers will need to have a payment method from a supported bank or payment card provider, please see the Android Pay help page for more details;

Figure 20: Stripe Instant checkout configuration

1. Enabled: Enable or disable the payment method.

2. Title: This is the name of the payment method as it will be seen by the customer at the checkout page.

3. Transaction Action : Identify the “Transaction Action” drop down field, single click the arrow

to right of field and select preferred option.

*Note – Choose either “Authorize Only” or “Authorize and Capture”. Authorize Only will not create an invoice for the order on order placement. Authorize and Capture will create an invoice for the order on order placement.

4. Sort Order: If you have many payment methods enabled, this setting will determine the order of this payment method at the checkout page. This is a global sort order that can be set for any

payment method, including PayPal and the original Stripe Payments.

Identify and click “Save Config” to save your admin payment method changes.

Figure 21: Save all admin configuration of Stripe payment modules

D)Stripe Cron jobs configuration

You need to make sure cron jobs for stripe is configured properly. This is required when you use redirect methods like GiroPay, SoFort, SEPA..

To configure cron jobs go to

Store -> Configuration -> Advanced -> System

You can only need to check the field “Generate Schedules Every”. This mean a cron job will be add to the queue after specified minutes. If you have a large store with many orders you may need to decrease this value.

5. Front End

   1. Checkout with Stripe Sofort,Bancontact,P24,GiroPay,Ideal,AliPay How to test Bancontact, Giropay, iDEAL ,P24,AliPay And SOFORT

These payment methods do not request any input from the customer during the checkout.These

payment method support only EURO currency.

Figure 22: Stripe Sofort module at checkout frontend page(same as Ideal,Alipay,Bancontact,P24,Giropay)

Place an order with any of the module’s payment methods (Redirect Methods)

If the Stripe Payments module is configured to be in Test Mode, then you will be redirected to a Stripe testing page for the selected payment method. An order will also be created in your Magento admin with the “Pending” order status. From the Stripe testing page, you can select to either

Authorize or Fail the payment. If Stripe Wbhooks have been configured correctly, then as soon as the payment is authorized, the order status will change based on the same rules described for the Stripe SEPA payment method.

From your Stripe Events section, locate the source.chargeable event for the order you placed.

Figure 23: Created order in stripe dashboard

sourc.chargeable

Figure 24: Stripe dashboard

account and your bank to debit your account in accordance with those instructions. You are entitled to a refund from your bank under the terms and conditions of your agreement with your bank. A refund must be claimed within 8 weeks starting from the date on which your account was debited.

The details of the accepted mandate is generated as part of the Source object creation. A URL to view the mandate is returned as the value for sepa_debit[mandate_url]. Since this is the mandate that the customer has implicitly signed when accepting the terms suggested above, it must be communicated to them, either on the payment confirmation page or by email.

For More Details : https://stripe.com/docs/sources/sepa-debit

Submitting a SEPA Direct Debit Mandate to the banks

Once your customer has completed a SEPA Direct Debit mandate it needs to be submitted to the banks. This informs your customer’s bank of the SEPA Direct Debit mandate, and allows you to collect payments against it in future.

Submissions to the banking system are made directly to the bank using an XML file containing the mandate related data. More details on the submission process are available in our guide to

submitting messages to the banks.

Once submitted to the banks, the SEPA Direct Debit mandate will be active once the first payment is confirmed (see Timings). Once active you can start taking payments against it. The mandate

related data will also need to be submitted with each subsequent collection.

–don’t ship!

Within the scope of Sources, SEPA Direct Debit is a pull-based, reusable and asynchronous method of payment. This means that you take action to debit the amount from the customer’s account. It can take up to 14 business days to confirm the success or failure of a payment.

One important detail for businesses to realize is that although successful authorization indicates a very high likelihood of payment, funds are not guaranteed to businesses until they are actually

received, which is typically 2 business days later (but can be up to 14 days later). Once received, payments cannot be reversed except by Business-initiated refunds.

When get back success then automatically status is change then You can ship that order.

For more Details : https://stripe.com/docs/sources#synchronous-or-asynchronous-confirmation

–Dispute Liability

Learn what disputes are, how the process works, and how to prevent them from happening.

Preventing disputes and fraud

The best way to manage disputes is to prevent them from happening. Refer to our prevention guide to learn how.

A dispute (also known as a chargeback) occurs when a cardholder questions your payment with their card

issuer. The issuer creates a formal dispute which immediately reverses the payment. The payment amount, along with a separate €15.00 dispute fee (for users in Germany) levied by the card network, is then deducted from your account balance.

There is a dispute resolution process through which you can respond and submit evidence to make your case that the payment was valid. If the dispute is found in your favor, the disputed amount and fee is returned back to you. If a dispute is upheld, the card issuer’s decision is final and the cardholder’s payment remains refunded.

For more Details : https://stripe.com/docs/disputes

LJ

^{Customer Merchant} Validation authority

Customer aittempts payment on merchant‘s website

Merchant asks customer to validate their identity

……………………………………………..fc vJa.routing service ) !?ti►

Customer is routed to validation authority

Customer is asked to enter agreed authorisation credentials

Ye:s

Customer is presented with authorisation farm including E–rnandate data

Customer verifies data and chooses an account

tamer is redirected back

How to test Sepa Direct Debit

This payment method take request any input from the customer during the checkout.Input is IBAN number and validate the IBAN number at that time.When Customer give input wrong input then He got massage to enter valid IBAN number.

This payemnt method support only EURO currency.

There is checkbox of term and condition when customer check the checkbox then Customer able to place order through Sepa.

Below Term & condition there is Description part to customer .This will be show when admin give input from admin sepa configuration.

Figure 25: Stripe sepa at checkout frontend page

C)Checkout with Stripe Credit cards

How to test Stripe Credit card

This payment method take request any input from the customer during the checkout.It takes card details and support only visa & master cards.

After enter card details customer successfull create an order with stripe credit cards payment gateway.

Figure 26:Credit card checkout front page

D )Checkout with Stripe Instant checkout

How to test Stripe Instant checkout

This Payment method support only HTTPS and takes request any input from the customer during the checkout.Using this payemnt method need to add some card details at this url

https://payments.google.com .After adding card detail Customer see A extra button in product

detail page and minicart page.Button name is PAY NOW. After click on this button one popup is open.Then customer fill all shiiping & billing address details and choose shipping method .Doing these processes customer confirm to checkout and then Order is placed successfull.

Checkout with instant checkout at frontend

instant checkout shpping and payemnt method selected value

Instant checkout shpping address selection

instant checkout details of shipping and payemnt

Aleady Saved crad detail and new selection of card

add new card

checkout confiemation

Order Creattion with instant checkout

6. Invoice Creation

After place order when webhook event get update source.chargeable to charge.succeeded then

Automatically Invoice generated of that oder.

7. Refund Creation

1. Go to Admin Dashboard Sales > Orders, then find and click the order you would like to refund.

2. From the left sidebar, click Invoices, then click on the invoice to refund.

Created order list in admin dashboard

Find Select any order to refund.

Created invoiced of Order

3. At the top right hand corner, click Credit Memo

4. Adjust the amount if necessary and click Refund at the bottom of the page to perform a live refund. If you click Refund Offline, the refund will only be issued in Magento but not in Stripe (an offline refund).

To create refund from admin dashboard

5. If selected Refund then see the screen shot for stripe dashboard.

Order detail in stripe dashboard

6. For a partial refund, you can adjust the “Adjustment Fee”. The amount you enter here is the

amount that will not be refunded. when the adjustment fee is EURO10, then EURO53.87 will be refunded and EURO10 will be kept as a fee. You can ignore the “Adjustment Refund” field because Stripe cannot refund an amount that is greater than the original payment of the customer.

1. The amount should now be fully or partially refunded in Stripe and a note should appear in the Comments History of the order.

It is also perfectly fine to perform a refund directly from Stripe’s dashboard; however doing so will not update Magento’s dashboard figures on the total amount of sales, nor will it update the order

status, so we recommend to perform refunds through Magento whenever possible.

8. Despute Maganement

Learn how to best protect against disputes and fraudulent payments.

Dispute categories

Fraud is the most cause of disputes, though there are other reasons why customers may question a payment. Refer to our dispute categories documentation to learn more.

Disputes are an unfortunate aspect of accepting payments online and the best way to manage them

is to prevent them from happening at all. An effective dispute and fraud prevention strategy uses a number of methods that are best suited for your business while keeping any customer burden—and losses—to a minimum.

Radar, our fraud prevention toolset, is built directly into the payment flow and combines a

customizable rules engine with powerful machine learning algorithms. This process detects patterns across payments processed with Stripe, assessing the risk level of each.

Use the following information to create an effective disputes and fraud prevention strategy. Depending on the service you provide, the goods you sell, or how your business operates, certain methods may be more effective than others.

Stripe Radar: Stripe provides a powerful fraud prevention feature called Stripe Radar which in combination with the above information that the module sends, it can be configured with flexible

and sophisticated rules to automatically decline payments from customers that are suspected to be using a fraudulent card. When enabled in the module, card payments that are marked by Stripe to

have an “Elevated” risk profile, will automatically switch to “Suspected Fraud” status, and a manual review of the payment will be necessary before the order is fulfilled. If the risk is a false positive,

the payment can be manually captured from Magento, and the order will switch back to “Processing” status.

For More Details : https://stripe.com/docs/disputes/prevention Using Radar reviews: https://stripe.com/docs/radar/review

9. Stripe Account & Reporting

Generate reports of your Stripe account’s financial information in the Dashboard.

Time zone in the Dashboard

The Dashboard uses the time zone specified in your account settings. Reports, API responses, and the timing of your subscriptions and payouts always use UTC (Coordinated Universal Time).

If you use a different time zone for your record-keeping, this needs to be taken into account when using an exported report.

Understanding how funds flow in and out of your account is an important part of processing

payments. Use the Dashboard to view information about the different types of account activity, which can be exported into a CSV-formatted report for use in spreadsheet apps.

For more Details : https://stripe.com/docs/account

https://support.stripe.com/questions/using-the-stripe-dashboard https://stripe.com/docs/dashboard/reporting

10. Troubleshooting / FAQs

I’m getting “Stripe SKD need to be installed” when trying to save stripe configurations

This may happen when you install stripe modules with composer and stripe skd isn’t installed automatically. You can install the sdk by running “Composer require stripe/stripe-php”

My order is not updated when I capture the transaction in Stripe Dashboard?

This issue is caused by missing webhook. You need to go to stripe dashboard and create a webhook so it can send informations to magento when transactions are updated

What is the url of the webhook?

The url is /stripe/wehook relate to your server base url. For example if your domain is example.com the full url to webhook you should use to register webhook is example.com/stripe/webhook.

I can’t make order with SEPA method?

SEPA is not activated by default after you create your stripe account. To have this feature you can contact Stripe support team so they can help you to enable this.

Pay Now button doesn’t appear on my website.

Pay Now only works in https so make sure you have a valid ssl certificate for your domain. Also you need to have at least one card added in your payment manager like google pay or apple pay.

I have webhook configured but my order still not updated

You can check if you configure cron job for stripe already. Cron jobs will run automaticially and proceed orders that placed with stripe payment methods.

Some of these payment methods are processed asynchronously and require Webhooks notifications to be set up correctly and Cron to be running on your server.