Accept payments in your Android app.

1. 01

   Create the order on your backend

   POST /v1/orders

   Send catalog variant ids and quantities, and Flint prices the order, with tax when you turn it on. Then read the order: its payment_collection names the Stripe publishable key and account the app initializes Stripe's SDK with. It holds no secrets, so send it to the app as returned.

   One line item from your catalogCopy

   curl -X POST https://api.withflintpay.com/v1/orders \
     -H "Authorization: Bearer YOUR_API_KEY" \
     -H "Idempotency-Key: order-app-7f3c" \
     -H "Content-Type: application/json" \
     -d '{
       "line_items": [
         {
           "type": "variant",
           "variant_id": "var_1kmn0aExample",
           "quantity": 1
         }
       ]
     }'

   The app sends what the buyer picked. The price comes from your catalog, never from the app.

   GET /v1/orders/{order_id}Copy

   {
     "order_id": "ord_1kmn0aExample",
     "version": 1790760000,
     "settlement_amounts": {
       "outstanding_money": { "amount": 18000, "currency": "USD" }
     },
     "payment_collection": {
       "stripe": {
         "account_id": "acct_1AbcPlaceholder",
         "publishable_key": "pk_test_51AbcPlaceholder",
         "elements": {
           "next_step": "collect_payment_source",
           "submit_to": "pay_order",
           "amount_money": { "amount": 18000, "currency": "USD" },
           "payment_method_types": ["card"]
         }
       }
     }
   }

   Keep the balance and version on your backend. They are what the buyer approves, and the pay call sends them back.

2. 02

   Collect the card in the app

   Stripe.createPaymentMethod

   Initialize Stripe’s Android SDK with the key and account from the order, take the card in its card field, and call createPaymentMethod. That creates a single-use credential and charges nothing.

   Kotlin, in the appCopy

   // publishableKey and accountId come from the order's
   // payment_collection, which your backend passed to the app
   val stripe = Stripe(context, publishableKey, stripeAccountId = accountId)
   
   val params = cardInputWidget.paymentMethodCreateParams ?: return
   val paymentMethod = stripe.createPaymentMethod(params)
   
   // your own endpoint, which calls Flint with your key
   val result = backend.payOrder(orderId, paymentMethod.id)

   The card field is an Android View. In a Jetpack Compose screen, host it with AndroidView.

   Card numbers go from Stripe's field to Stripe. They never reach your servers or Flint's.

   pm_…

   The app never creates or confirms a PaymentIntent, so there is no client secret to fetch before the buyer pays.

   next_step: collect_payment_source

   The publishable key and account come from the order on each checkout, so the app holds no Stripe configuration of its own.

   payment_collection.stripe
3. 03

   Pay the order from your backend

   POST /v1/orders/{order_id}/pay

   Send the PaymentMethod id as the payment source, with the balance and version the buyer approved. Flint creates a payment for the full balance and confirms it in the same request. If the order changed since the buyer saw it, Flint refuses before charging, so the app can show the new total.

   From your backend, with your keyCopy

   curl -X POST https://api.withflintpay.com/v1/orders/ord_1kmn0aExample/pay \
     -H "Authorization: Bearer YOUR_API_KEY" \
     -H "Idempotency-Key: pay-ord_1kmn0aExample-pm_1kmn0aExample" \
     -H "Content-Type: application/json" \
     -d '{
       "action": "pay",
       "payment_source": {
         "credential_type": "token",
         "token": "pm_1kmn0aExample"
       },
       "expected_outstanding_money": {
         "amount": 18000,
         "currency": "USD"
       },
       "expected_version": 1790760000,
       "buyer_contact": { "email": "sam@example.com" }
     }'

   An Idempotency-Key built from the order and the single-use card makes a network retry safe: Flint returns the first result instead of charging twice.

   The responseCopy

   {
     "order": {
       "order_id": "ord_1kmn0aExample",
       "status": "closed",
       "payment_status": "paid"
     },
     "order_payment_attempt": {
       "order_payment_attempt_id": "opat_1kmn0aExample",
       "status": "succeeded",
       "pending_actions": []
     }
   }

   • succeededShow the confirmation. Fulfill from the order.paid webhook.
   • requires_actionRun the client action in the app, then resume.
   • failedNothing was charged. Show the decline message and take a new card.
   • processingDon't start another payment. Resume or read the attempt again.
4. 04

   Run 3D Secure in the app when the bank asks

   handleNextActionForPayment

   When the issuer wants the buyer to authenticate, the attempt pauses with a pending action. Your backend passes its Stripe client secret to the app, the app runs Stripe's handleNextActionForPayment, and your backend resumes the attempt. That client secret is the only one Flint returns, and it goes to that one call.

   Kotlin, in the appCopy

   // action is the pending action's client action,
   // which your backend passed back to the app
   val stripe = Stripe(context, action.publishableKey, stripeAccountId = action.accountId)
   stripe.handleNextActionForPayment(activity, action.clientSecret)
   
   // when the result comes back to the activity, call your
   // backend, which resumes the attempt (below). Resume even
   // after an error: Flint reads the real outcome from Stripe.

   Then your backend resumesCopy

   curl -X POST https://api.withflintpay.com/v1/orders/ord_1kmn0aExample/pay \
     -H "Authorization: Bearer YOUR_API_KEY" \
     -H "Idempotency-Key: resume-opat_1kmn0aExample-1" \
     -H "Content-Type: application/json" \
     -d '{
       "action": "resume",
       "order_payment_attempt_id": "opat_1kmn0aExample",
       "expected_outstanding_money": {
         "amount": 18000,
         "currency": "USD"
       }
     }'

   A new Idempotency-Key, and no payment source: the resume continues the same attempt.

   What the pay call returns insteadCopy

   {
     "order_payment_attempt": {
       "order_payment_attempt_id": "opat_1kmn0aExample",
       "status": "requires_action",
       "is_resumable": true,
       "pending_actions": [
         {
           "action_type": "payment_authentication",
           "client_action": {
             "stripe": {
               "account_id": "acct_1AbcPlaceholder",
               "publishable_key": "pk_test_51AbcPlaceholder",
               "payment_intent": {
                 "stripe_js_call": "handle_next_action",
                 "client_secret": "pi_3AbcPlaceholder_secret_XyzPlaceholder"
               }
             }
           }
         }
       ]
     }
   }

   An attempt still waiting for authentication 30 minutes after it started is canceled, and the buyer pays again with a new card.

Fulfill from the order.paid webhook or a fresh read of the order on your backend, not from what the app shows: a buyer can close the app before it hears the result. The declines and payment attempts guide covers retrying with a new card after a decline.

reviewed 2026-10-30 against the embedded payments guide and Stripe's Android docs · corrections: Flint Help

curl -X POST https://api.withflintpay.com/v1/checkout-sessions \
  -H "Authorization: Bearer YOUR_API_KEY" \
  -H "Idempotency-Key: checkout-ord_1kmn0aExample" \
  -H "Content-Type: application/json" \
  -d '{
    "type": "order",
    "order_id": "ord_1kmn0aExample",
    "redirects": {
      "success_url": "https://studio.example.com/app/paid"
    }
  }'

// url is the checkout session's url, from your backend
CustomTabsIntent.Builder().build()
    .launchUrl(context, Uri.parse(url))

The checkout sessions guide covers every redirect and session setting. For a fixed product, a payment link is a hosted checkout your app can open with no backend call at all.