Payments Preflight · Check 13 of 15

Rate limit checkout session creation

Limit how often one user or IP can create Checkout Sessions or PaymentIntents. It slows card testing and protects your Stripe API rate limit.

What it is

A per-user or per-IP limit on the route that creates Checkout Sessions, PaymentIntents or SetupIntents.

Why it matters

Card testers use open payment endpoints to check stolen cards. Stripe also rate limits API requests per account and returns 429 when you exceed it, so a flood can break checkout for real customers.

How to check

• Call your checkout route in a loop from a script. Does anything stop you?
• Check whether anonymous users can create sessions at all.
• Check your logs for 429 responses from Stripe.

How to fix it

1. Add a rate limit (for example per IP and per user) on payment routes.
2. Require sign-in before checkout where that fits your product.
3. Handle 429 from Stripe with retries and back off. Prefer Checkout or the Payment Element, which include Stripe's own card testing controls.

Prompt for your AI coding tool

Paste into Cursor, Claude Code, Lovable or similar. Review the diff before you accept it.

Add rate limiting to every route that creates a Stripe Checkout Session, PaymentIntent or SetupIntent: a small per-IP and per-user limit returning 429. Require an authenticated user where the product allows it. Handle Stripe 429 errors with retry and back off. Show the diff and the limits you chose.

Sources

• Card testing Stripe docs
• Rate limits Stripe docs

Related checks

• Rate limit expensive and auth endpoints
• Add bot protection to public forms

All payments checks

Sponsor this page: get in touch.