PayPal and Stripe

Use the gateways' hosted pieces, such as Stripe Checkout 238 or Elements and PayPal 174 's JavaScript SDK buttons: card numbers then go straight to the gateway and never touch your server, keeping your PCI DSS scope small. Your server still creates the order and confirms payment from a webhook, never from a success message in the browser. For the browser-native Payment Request API, see Payment Request.