1. Overview

ONEcount uses Stripe as its payment gateway for processing credit card payments. Stripe handles all card data securely — credit card numbers never touch ONEcount's servers. This guide covers how to process payments from the admin side (phone orders) and what happens behind the scenes when a subscriber pays on the web.

Two payment entry points:

• Web checkout — subscribers pay on your subscription forms. Stripe Elements (a secure card input widget) collects the card details directly from the browser to Stripe. ONEcount receives only a token, never the card number.
• Admin payment entry — your circ team takes a phone order and enters the card via the same Stripe Elements widget in the admin interface. Same security posture — card data goes straight to Stripe.

2. Before You Start

Prerequisites:

• A Stripe account (stripe.com). You can start with test mode — no real charges until you switch to live keys.
• Your Stripe API keys configured in ONEcount: go to Payment Processors in the admin and add a processor with type 'stripe'. Enter the secret key (sk_test_... or sk_live_...), publishable key (pk_test_... or pk_live_...), webhook secret, and environment (sandbox or production).
• A webhook endpoint registered in Stripe Dashboard: Settings, then Webhooks, then Add endpoint. The URL is https://CUST-reg.onecount.net/payment/stripe-webhook.php. Select these events: payment_intent.succeeded, payment_intent.payment_failed, charge.refunded, invoice.paid, invoice.payment_failed, customer.subscription.deleted.
• At least one paid publication configured in Fulfillment Setup with active terms (products) that have prices.

3. Processing a Phone Order (Admin Payment Entry)

When a subscriber calls to subscribe or renew by phone, use the Admin Payment Entry page to process their credit card.

3.1 Navigate to Payment Entry

From the left navigation, choose Fulfillment, then Payment Entry. The page has three steps: Subscriber, Subscription Term, and Payment.

3.2 Step 1 — Look up the subscriber

Enter the subscriber's OCID in the lookup field and click Look Up. The system displays their name, email, and address. If the subscriber is new, create their record first in the standard subscriber management interface, then return here with their OCID.

3.3 Step 2 — Select the term

Select the publication from the dropdown. The Term dropdown populates with the publication's active terms (e.g., Print Annual — $49.95, Digital Annual — $49.95). Select the term the subscriber wants. The amount displays below.

3.4 Step 3 — Enter payment

The card input field is a Stripe Elements widget. Ask the subscriber to read their card number, expiration date, and CVC. Type them into the card field. Stripe validates the card format in real time.

When the card field shows a green checkmark, click Process Payment. A confirmation dialog shows the amount and OCID. Click OK to charge the card.

On success, a green confirmation appears with the Stripe transaction ID. The subscriber's payment method is stored securely in Stripe for future use (renewals). On failure, the error message from Stripe appears — common reasons are insufficient funds, incorrect card number, or expired card.

3.5 What happens behind the scenes

When you process a payment, the system:

1. Creates a Stripe Customer for the subscriber (or reuses an existing one if they have paid before).
2. Attaches the payment method (card) to the Stripe Customer.
3. Creates a Stripe PaymentIntent and confirms the charge.
4. Stores the Stripe customer ID and payment method token in ONEcount (never the card number).
5. Logs the payment event to the payment_event tables in ONEcount.
6. Writes a row to gcn_transactionlog in MySQL for backward compatibility with existing reports.
7. If the publication has auto-renew enabled, creates a Stripe Subscription for automatic renewal at the end of the term.

4. Web Checkout

When a subscriber pays through your subscription form on the website, the same Stripe Elements widget handles the card input. The flow is identical to the admin payment entry — the card goes directly to Stripe, ONEcount receives only a token, and the same backend processing applies.

No additional setup is needed beyond configuring the Stripe credentials. All existing subscription forms automatically use Stripe when it is configured as the payment processor.

5. Payment History

Every payment, renewal, refund, and failed charge is logged to Cassandra in the payment_event_by_subscriber table. This data is available in two places:

• My Reports — payment events appear as ACS_IMPORT-style runs in the fulfillment report history, with downloadable summary CSVs.
• Superset dashboards — after the MongoDB sync job runs (multiple times per day), payment events are available as a Superset dataset for interactive analysis: payments by channel, by publication, by card brand, failed payment funnel, etc.

6. Security and PCI Compliance

ONEcount maintains PCI SAQ A-EP compliance through Stripe Elements. This means:

• Card numbers, CVCs, and full expiration dates NEVER pass through ONEcount's servers. The Stripe Elements iframe sends card data directly to Stripe's PCI Level 1 certified infrastructure.
• ONEcount stores only display metadata: card brand (Visa, Mastercard), last 4 digits, and expiry month/year. These are sufficient to show the subscriber which card is on file without exposing sensitive data.
• Stripe's opaque tokens (pm_xxxx, cus_xxxx) are stored in ONEcount. These tokens cannot be used to retrieve the full card number — they can only be used through Stripe's API with your secret key.
• Never ask a subscriber to email or chat their card number. Always use the Stripe Elements widget — either on the web form or in the admin payment entry page.

7. Troubleshooting

'Stripe not configured' message on Payment Entry

No Stripe credentials have been entered. Go to Payment Processors in the admin, add a processor with type 'stripe', and enter your API keys. Then return to Payment Entry.

Card is declined

Stripe returns the decline reason from the card issuer. Common reasons: insufficient funds, incorrect card number, expired card, or the issuer blocked the transaction. Ask the subscriber to try a different card or contact their bank.

'Requires additional authentication'

Some cards require 3D Secure authentication (a popup from the card issuer). For web checkout, Stripe handles this automatically. For admin phone orders, 3D Secure cannot be completed — the subscriber will need to complete the payment through the web form instead.

Payment succeeded but no webhook received

Check that the webhook endpoint URL is correctly registered in your Stripe Dashboard (Settings, then Webhooks). The URL must be https and publicly accessible. Also verify the webhook signing secret matches what is configured in ONEcount's Payment Processors settings.

Test cards for sandbox mode

When the environment is set to 'sandbox', use these Stripe test cards:

• 4242 4242 4242 4242 — always succeeds.
• 4000 0000 0000 0002 — always declines.
• 4000 0000 0000 3220 — triggers 3D Secure authentication.
• Any future expiration date and any 3-digit CVC.

8. Where to Learn More

• Stripe Dashboard: dashboard.stripe.com (payment history, refunds, subscription management, webhook logs)
• Stripe test mode documentation: stripe.com/docs/testing
• Recurring Billing How-To: docs/fulfillment/howto-recurring-billing/
• Revenue Recognition & Financial Export How-To: docs/fulfillment/howto-revenue-export/
• Architecture Decision Record: docs/decisions/0005-stripe-payments-revenue-recognition.md