Stripe Checkout and Payment Links: which to use, and what Stripe handles for you

Two doors to the same payment page

Stripe's documentation states that Payment Links use Checkout, so most of what applies to one applies to the other. The difference is how the payment page is created. A Payment Link is created once, in the Stripe Dashboard or through the API, and reused: Stripe says it can be used many times with many customers, or limited to a number of purchases. A Checkout Session is created by your server for each purchase, with the exact items, customer and options of that order.

What Stripe handles for you

• The payment form on a page Stripe hosts, adapted to the customer's language: Stripe says Payment Links support over 30 languages, matching the browser's language setting.
• Payment methods: Payment Links dynamically display over 40 payment methods, which you manage from the Dashboard without code; Stripe says the Checkout Sessions API supports more than 125 local payment methods for one-time and subscription payments.
• Local currency through Adaptive Pricing, where enabled.
• Tax: Stripe Tax is supported on both.
• Receipts and refunds: Payment Links offer automatic receipts and refunds without code.
• Promotions: promotion codes, optional items and upsells.

Card security and PCI: what changes, what stays yours

Stripe's integration security guide describes PCI compliance as a shared responsibility. Stripe is certified annually as a PCI Level 1 Service Provider; as a business accepting payments, you must accept them in a PCI-compliant way and attest to it every year. Stripe's low-risk integrations collect payment information and send it directly to Stripe without it passing through your servers, which reduces your PCI obligations; by contrast, handling card numbers yourself can mean meeting more than 300 security controls.

Some things stay yours: payment pages must use TLS 1.2 or above, all interactions between your server and Stripe must use HTTPS, and if you use webhooks you must verify their signatures.

Delivering the order: why webhooks are required

This is the part most small sites get wrong. Stripe's fulfilment guide says plainly that you cannot rely on triggering fulfilment only from your checkout landing page, because customers are not guaranteed to visit it: someone can pay and lose their connection before the page loads. Stripe states that webhooks are required for fulfilment, and specifically required if you sell subscriptions or accept payment methods whose success is confirmed later.

• Listen for the checkout.session.completed event, and for checkout.session.async_payment_succeeded for delayed payment methods such as bank debits.
• Write one fulfilment function that checks the session's payment status, delivers the order and records that it did.
• Make it safe to run several times: Stripe warns it may be called more than once, even concurrently, for the same session, and asks you to fulfil only once per payment.
• Also trigger it from the landing page if you want instant delivery while the customer is there; Stripe recommends this in addition to webhooks, not instead.

Which one should a small business use?

How we set up payments at Takat

On our own sites that sell, we use one-click Stripe checkout with the minimum of fields, tested on a 390-pixel-wide phone, a reassurance line under each button with true facts only, and instant delivery of digital products by email. See Payments and checkout and Landing pages.