Developer documents 5 undocumented Stripe Shared Payment Token API response quirks

·1 views

A developer building a payment system using Stripe's Shared Payment Tokens preview API (version 2026-04-22) discovered five undocumented response behaviors through real test-mode usage. Among the findings: declined charges return an HTTP 402 error with the PaymentIntent nested inside the error body, rather than a 200 with a failed status, which can cause silent failures if not handled carefully. A 200 response does not always indicate success, as 3D Secure authentication triggers return an empty action payload with zero funds captured. Payment method details such as card brand become unavailable after a token is consumed, meaning receipt data must be captured at grant time. The developer notes these are dated observations against a preview API and not guaranteed contracts, and has pinned each case in tests to guard against future regressions.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AntigravityCI lets developers trigger AI code refactoring via GitHub PR comments

A developer has released AntigravityCI, an open-source tool that transforms GitHub Pull Request comment sections into an AI-powered command terminal. Users can tag the bot with instructions directly in a PR, and it processes the request in under 1.5 seconds. The tool uses Google Gemini Flash models to analyze code diffs, apply changes on a temporary branch, and open a new PR for review. Built with Python, Docker, and GitHub Actions, it aims to eliminate the need to manually copy code into external chatbots. The project is publicly available on GitHub, with planned additions including support for other LLM backends and automated test execution.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Practical Guide to Implementing OAuth2 and OpenID Connect in Modern Apps

A technical guide published on DEV Community explains the distinct roles of OAuth2 and OpenID Connect (OIDC), two widely used but often confused security protocols. OAuth2 is an authorization framework that grants applications limited access to user resources, while OIDC is an authentication layer built on top of OAuth2 that identifies who the user is. For web and mobile applications, the guide recommends the Authorization Code Flow with PKCE to prevent authorization code interception attacks. It also details how to validate ID Tokens — which are JWTs — by verifying the signature, issuer, audience, expiry, and nonce using a provider's public JWKS endpoint. The guide further covers protecting APIs by validating access tokens on every request, either through local JWT verification or token introspection for opaque tokens.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

PostgreSQL Connection Strings Explained for Supabase, Neon, and Railway

A PostgreSQL connection string is a single URL containing the protocol, username, password, host, port, and database name needed to connect a client to a database. Supabase offers three distinct connection strings for the same database — direct, session pooler, and transaction pooler — and choosing the wrong one is a common source of silent failures, especially on IPv4-only networks or serverless environments. For serverless platforms like Vercel or AWS Lambda, the transaction pooler on port 6543 is the recommended option, as it is designed for many short-lived connections. Neon simplifies the choice by embedding pooler status directly in the hostname, with the pooler variant being the default recommendation for most use cases. Railway provides a straightforward single connection string with no pooler configuration required, and advises storing credentials in environment variables rather than in application code.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Sudo vs Root in Linux: Key Differences and Why It Matters for System Security

In Linux systems, root and sudo are often used interchangeably, but they represent fundamentally different concepts in system administration. Root is a superuser account with UID 0 that bypasses virtually all permission checks, granting unrestricted access to files, processes, and hardware. Sudo, by contrast, is a tool that temporarily delegates specific administrative privileges to regular users based on defined rules. Modern Linux distributions favor sudo over direct root login because it limits exposure, enforces accountability through logging, and reduces the risk of accidental or malicious system-wide damage. Understanding this distinction is considered essential knowledge for anyone managing Linux infrastructure safely.

0 comments Read more at DEV Community