I use Stripe for Gumroad and it's amazing. Unfortunately, it's still private for now.
+1 for Stripe
Ask HN: How are lean startups easily accepting CC payments?
61–70 of 125 posts
Re: Ask HN: How are lean startups easily accepting CC payments?
#62My opinion on this: it is very difficult for me to add value via coding the world's best possible rebilling user experience and backend admin code. It is orders of magnitude easier for me to add value via either marketing (which I need to do more of) or adding features to the product that get it in the hands of more customers.
This strongly suggests that I should not be writing billing code, ever.
You need a bunch of pieces to do billing. I use Paypal Website Payments Pro to physically charge people's credit cards, and Spreedly to tell them when to do it. I interact with Spreedly through a REST API that is wrapped with a Ruby gem. My entire interaction with them is one form, three model actions (which handle account creation, status change, and expiry), and a callback for when customer status changes. This took me a few hours to implement, once. Aside from a bug on my side (not charging Mastercards because I am illiterate and failed to read their documentation correctly), it has been pretty flawless.
This seems to come up way, way too often. Would anybody be interested in a blog post about how to do it in a practical, pain-minimizing manner?
Re: Ask HN: How are lean startups easily accepting CC payments?
#63[deleted]
Re: Ask HN: How are lean startups easily accepting CC payments?
#64Earlier quoted context omitted.
Authorize.net also offers a hosted option so that the merchant doesn't have to deal with the burden of PCI compliance. In other words, the merchant (you) never sees the credit card number. http://developer.authorize.net/api/sim/
They also have CIM, Customer Information Manager, where you send the credit card info (thus never storing it yourself) and you get back a token. Anytime you need to charge that card, you charge the token instead. PCI compliance is then on Authorize.net
Pretty much every gateway has some kind of tokenization solution (or reference transaction solution) that accomplishes the same thing. They all call it something different and try to make it seem like it is unique, which can be confusing.
Re: Ask HN: How are lean startups easily accepting CC payments?
#65My opinion on this: it is very difficult for me to add value via coding the world's best possible rebilling user experience and backend admin code. It is orders of magnitude easier for me to add value via either marketing (which I need to do more of) or adding features to the product that get it in the hands of more customers. This strongly suggests that I should not be writing billing code, ever. You need a bunch of…
I do believe a blog post about how to practically implement such things into a framework (say Rails or Django) would do well.
Re: Ask HN: How are lean startups easily accepting CC payments?
#66I started FeeFighters, which is like Kayak for merchant accounts.
I have seen a lot of misery from folks who used the recurring API of the gateways (such as auth.net, braintree, etc).
If you are going to do recurring payments either roll your own using tokenization (its not that hard if your billing logic is simple), or use Recurly/Spreedly/Chargify.
A big advantage that a lot of people don't immediately recognize is that using R/S/C gives you a really good CRUD for your users/subscriptions/payments/etc. Building out that interface properly isn't a good way to spend your time (spend it on customer facing stuff!).
Re: Ask HN: How are lean startups easily accepting CC payments?
#67Are any of the solutions out there comparable to BrainTree? It's easy to process CC's, even recurring, but it's a pain to do PCI compliance. If the CC info hits your server, you're in PCI scope. BrainTree has the browser send the info direct to them, then redirects with a token you can use to check information and perform charges. Anything else out there like that? That is, all the flexibility of being able to run ch…
As I mentioned above, Authorize.Net's CIM (Customer Information Manager) works in a similar way -- you send the credit card info from your website to Authorize.net (and never store it in between) and you get a token back which you can store, and which you can use to make charges later.
But if the CC info ever hits your server, your server, apps, etc. fall into scope. Not storing it just gets you out of a small part of PCI.
Re: Ask HN: How are lean startups easily accepting CC payments?
#68I have been considering FastSpring ( http://www.fastspring.com ), which has recently added subscription payments as a feature. I'm interested to hear about anyones experiences with them.
I believe you are referring to http://saasy.com/ It is a bundled payment gateway+merchant. You don't have to get PCI compliant and you don't need a merchant account (no min transaction volumes, fight chargebacks for you etc). The down side is they only offer hosted payment pages and not suitable for everything... You need a finite set of goods/services you want to sell (eg monthly plans). You can't automate the proce…
The terminology of payments is so weird:
Payment processors refer to their business customers as "merchants".
Entrepreneurs ALSO refer to their payment processors as "merchants".
Re: Ask HN: How are lean startups easily accepting CC payments?
#69Especially important for lean startups when considering payment providers for subscriptions is the ability to "take your customers with you" as you grow. When using Paypal, Clickbank, Fastspring/ Saasly, they are the merchant of record, so they "own" the customer data. If you ever want to move to a different provider, get your own or switch merchant accounts... the customers that signed up with these providers will need to signup for a new subscription and submit their CC data again to transition them to your new provider. The other option is you can continue to use these old providers for your existing subscribers, and use your new providers for new customers, but that adds a bunch of complexity for technology, customer support...
This isn't a unique issue with "merchant of record" companies, gateways like Auth.net have a real issue with this too, check out: http://community.developer.authorize.net/t5/Integration-and-...
http://www.braintreepaymentsolutions.com/blog/open-letter-to...
Re: Ask HN: How are lean startups easily accepting CC payments?
#70Earlier quoted context omitted.
Authorize.net also offers a hosted option so that the merchant doesn't have to deal with the burden of PCI compliance. In other words, the merchant (you) never sees the credit card number. http://developer.authorize.net/api/sim/
They also have CIM, Customer Information Manager, where you send the credit card info (thus never storing it yourself) and you get back a token. Anytime you need to charge that card, you charge the token instead. PCI compliance is then on Authorize.net
Even if you aren't storing card information you still are subject to PCI compliance if the card information passes through your application/server. In the case where you are processing but not storing you would need to complete the SAQ-C questionnaire and still probably be subject to quarterly scans (the self-assessment where are you storing data is SAQ-D)
https://www.pcisecuritystandards.org/merchants/self_assessme...