Payments

Tofu is not part of the sale. Your buyers pay on Stripe’s own payment page, into your Stripe account: Tofu never sees a card, holds no money and takes no fee on your sales. What Tofu does is the wiring — the connection to your account, the payment links your app sells through, the secret your app checks each payment’s event with, and the events themselves, passed on to your app.

Connect Stripe from your app’s Payments page in the dashboard. A payment link of your own also takes payments in every app, a static site included.

Your app needs a server to hear about payments. Connecting and testing come with a paid plan, its free trial included, and real payments open once the plan’s first month is paid.

Your app hears about each payment at a webhook route in its own code. The route checks each event’s signature with Stripe’s own library and a secret Tofu saves for it. It needs no Stripe key, because it never calls Stripe: everything it needs — who paid, how much, whether it was paid — is in the event.

On the Payments page, Set up events takes the route’s path and the name your code reads the secret from — STRIPE_WEBHOOK_SECRET unless you choose another. Tofu saves the secret as a hidden value in your app’s settings, never over a value of your own, and sends the route one request with no signature, which it must refuse:

The saved secret reaches your app with its next deploy, so press Put it online now. Until Stripe lets Tofu’s app create endpoints in your account, Tofu passes each event on itself, from Tofu’s own servers and signed the way Stripe signs them, so the code above accepts it as it is: don’t limit the route to Stripe’s IP addresses. An event can arrive more than once, so handle each event ID once. A delivery your app doesn’t take is tried again on Stripe’s own schedule — for up to 3 days for a real payment, a few hours for a test one. While your app keeps failing, Tofu holds its events and sends them once its route answers again, but for no more than 3 days from when each arrived, so fix a failing route before then: an event your app hasn’t taken by then isn’t delivered, though its payment stays recorded in your Stripe account.

Create payment link takes a name your buyers see, an amount, a currency and — once your Stripe account allows it — how often it repeats, and shows you what it will make before it does. Tofu creates the product, its price and the link in your Stripe account, and the Payments page lists each link with how often it repeats and its newest payment — for a link that repeats, its newest sign-up, since each renewal is an invoice that your Stripe Dashboard lists and Deliveries shows reaching your app. Put the link on a button, and add the signed-in person’s ID as client_reference_id, so each payment’s event says who paid — an ID, never an email address.

Choose how often a link repeats in Create payment link’s Repeats — your coding agent can also make one repeat every few days, weeks, months or years, at most three years apart — and the link makes a subscription in your Stripe account: Stripe charges each buyer again every period until the subscription is cancelled. Tofu passes your app the subscription’s events as well as its first payment, from Tofu’s own servers and signed the way Stripe signs them, so the webhook route above checks them as they are, and handles each event ID once.

Set up events forwards these beside a checkout’s, a link that repeats adds them for an app set up before, and setting up again keeps them while the app has such a link, turned off or not. Only the first payment’s event carries client_reference_id: record which person its subscription is for, because a renewal’s invoice names the subscription alone. An invoice’s event carries the buyer’s email and address, and passes through Tofu like a checkout’s: held encrypted until your app takes it, for at most 3 days, and never logged.

Repeats appears once your Stripe account has approved the permissions that let Tofu pass a subscription’s events on. An account that installed Tofu’s app before it asked for them approves them in Stripe, which asks by email and on Tofu’s app in your Stripe Dashboard (Settings → Installed Apps); until then your links are one-time, and the Payments page says so. Right after you install, Stripe takes a minute or so to tell Tofu what the install allows, and the page checks again by itself meanwhile.

You cancel or change a subscription in your Stripe Dashboard, and your app hears it. A subscription keeps renewing in Stripe until it is cancelled there — also after you turn its link off or disconnect, when your app no longer hears about it.

In a sandbox, pay with Stripe’s test card 4242 4242 4242 4242, any future date and any CVC: no money moves. The Payments page’s Deliveries lists each event Tofu passed on with the status code your app answered, and says Test payment received once your app took one. Then check that your app unlocked what was bought. Stripe sends no receipt for a test payment by itself.

Real payments open once your paid plan’s first month is paid, and need two things done with your test connection first: your webhook route passed Tofu’s check (it refused the unsigned request, so it checks signatures), and a test payment reached your app. Until both are done, the Payments page says which is left where Connect your live account will be, and your coding agent is refused the same step. Then Connect your live account installs Tofu’s app in your live Stripe account and replaces the test connection, taking out the values it saved. Set up events and create your links again there, clear what test payments unlocked — their events carried livemode: false — and put your app online.

Every step on the Payments page is one of your coding agent’s tools as well, each with a command for the command line. The three that change something carry confirmed: true only after you agreed to that exact step. They run on the agent client installed on your computer; a chat app connected by address doesn’t offer them.

Disconnect Stripe on the Payments page ends the connection after you type the app’s name — its letter case as it is, a straight or curly apostrophe either way: Tofu stops passing on its events, removes what it saved in the app and forgets what it recorded but a dated line of what was done. A payment link left on keeps taking payments your app no longer hears about, so the dialog lists the links Tofu created and turns off the ones you tick — none until you do. Your Stripe account, its data and its money stay as they are.

Uninstalling Tofu’s app in Stripe (Settings → Installed Apps) ends the connection too, but then Tofu can no longer reach that account to turn links off there.

Stripe records every payment in your account, but with a link of your own your app is not told who paid, so nothing in it unlocks by itself. It suits a deposit, a tip, a single item or a booking fee — Frank’s Kitchen taking a deposit for a table, say. An app with its own Stripe code — a checkout its server starts, a webhook it checks — needs your Stripe secret key and webhook signing secret: you type them in Keys & settings with Hide this value after saving on, never in a chat (Environment variables).