Hey guys! Hope everyone is doing good. I have a qu...
# help
y
Hey guys! Hope everyone is doing good. I have a question on building a Serverless Payment System with Stripe. Is it possible to create a serverless app with SST that can allow multiple applications to talk to different Stripe Endpoint? Let me know your thoughts or if anything unclear, let me know so I can try to explain it better. Thanks in advance guys!
o
Don't think SST or serverless has any impact on calling the Stripe API...did you have a specific problem?
f
I second @Omi Chowdhury. Definitely possible.
y
Because it will contain different Stripe Secret Key, whenever an application call my serverless app, I need to determine what’s the app calling my serverless function, then load the stripe based on the their secret key
In my opinion, I think has some security issue
Any opinion on this?
o
The different applications will be authenticating to your API, right? You can use various methods (OAuth 2, static API keys etc) - and use API Gateway to authenticate it, One way is to issue JWTs to each application and use a JWT Authorizer in API Gateway: https://docs.serverless-stack.com/constructs/Api#adding-jwt-authorization You can generate your own JWTs using a lib, or use a tool like cognito or auth0 to generate them, and check them in the authorizer. Another way is to issue static api tokens to each application, and use a Lambda Authorizer to check it and look up which one called the API
y
Yea I think I will not have problems tracking which one called the API. But the problem is, how to direct those application to talk to DIFFERENT STRIPE API. As each Stripe API requires different Secret_Key, which is not a good idea to be passing around the key or putting it in the token. And also doing if else check on the application that is calling the API and attach their specific Secret Key is not scalable or dynamic enough.
o
Retrieve the stripe token at runtime based on the application. You can store it encrypted in your DB, store them in AWS secrets manager (expensive), or parameter store, or use something like hashicorp vault - I think they are coming out with a serverless version, but it was expensive to get started last time I checked