A checkout interface and a payment system perform different jobs. The interface collects the customer’s choice; the system must determine whether money was authorized, captured, refunded or disputed. A research-materials storefront needs this distinction just as much as any other business.

Stripe’s official documentation describes webhooks for asynchronous events and idempotent requests for avoiding duplicate operations during retries. These are examples of integration controls, not an endorsement of a provider for a particular merchant category. Stripe webhook documentation Stripe idempotent request documentation

Model the order lifecycle explicitly

An order should have understandable states such as awaiting payment, confirmed, fulfilled, refunded and disputed. A customer reaching a success page is not, by itself, the authoritative record that payment has settled. The server-side record should reconcile with the provider’s actual payment state.

Duplicate notifications and interrupted connections are normal integration conditions. The design should recognize repeated events and prevent duplicate fulfillment. It should also preserve an audit trail when a later event changes the outcome, such as a refund or dispute.

Protect payment data by design

Minimize the card information the merchant’s systems handle. Use the provider’s supported collection method and keep secrets out of client code and logs. PCI SSC advises merchants to determine applicable validation and reporting requirements with their acquirer or payment brand. Outsourcing part of checkout does not justify assuming that all responsibilities disappear. PCI SSC merchant resources

Before launch, test abandoned checkout, declined payment, delayed confirmation, duplicate delivery and refund reconciliation. Keep these tests in a sandbox and use test data.

AXON’s technical conclusion is that reliable payments depend on explicit states, authenticated events and reconciliation. Acceptance rates should be measured after a compliant integration is established, with a defined denominator, rather than used as a reason to weaken fraud or security controls.