Stripe Apple Pay集成：如何获取PaymentIntent客户端密钥？

你遇到的secret format does not match expected client secret formatting错误，核心原因是传入的clientSecret格式不符合Stripe要求——正确的PaymentIntent客户端密钥格式为pi_xxx_secret_xxx结构，而非PaymentIntent ID（pi_xxx）或其他类型密钥。以下是具体解决步骤：

1. 后端生成正确的客户端密钥 #

你需要在后端创建PaymentIntent对象，而非直接返回密钥。创建时需指定金额、货币，并确保支付方式包含apple_pay，之后从返回对象中提取client_secret字段，这才是前端所需的字符串。

示例后端代码（Node.js）：

const stripe = require('stripe')('你的Stripe秘钥（sk_开头）');

app.post('/create-payment-intent', async (req, res) => {
  const { amount } = req.body;

  const paymentIntent = await stripe.paymentIntents.create({
    amount: amount, // 单位为分，如100代表1美元
    currency: 'usd',
    payment_method_types: ['apple_pay'],
  });

  res.json({ clientSecret: paymentIntent.client_secret });
});

2. 前端修改密钥获取逻辑 #

替换你代码中let clientSecret = ...的部分，通过调用后端接口获取正确的客户端密钥：

func applePayContext(_ context: STPApplePayContext, didCreatePaymentMethod paymentMethod: StripeAPI.PaymentMethod, paymentInformation: PKPayment, completion: @escaping STPIntentClientSecretCompletionBlock) {
    // 调用后端接口获取clientSecret
    guard let url = URL(string: "https://你的后端域名/create-payment-intent") else {
        completion(nil, NSError(domain: "URLInvalid", code: -1, userInfo: [NSLocalizedDescriptionKey: "Invalid backend URL"]))
        return
    }
    
    var request = URLRequest(url: url)
    request.httpMethod = "POST"
    request.setValue("application/json", forHTTPHeaderField: "Content-Type")
    
    let bodyParams = ["amount": 100] // 根据实际订单金额调整
    do {
        request.httpBody = try JSONSerialization.data(withJSONObject: bodyParams)
    } catch {
        completion(nil, error)
        return
    }
    
    URLSession.shared.dataTask(with: request) { data, response, error in
        DispatchQueue.main.async {
            if let error = error {
                completion(nil, error)
                return
            }
            
            guard let data = data else {
                completion(nil, NSError(domain: "BackendError", code: -2, userInfo: [NSLocalizedDescriptionKey: "No data received from backend"]))
                return
            }
            
            do {
                guard let result = try JSONSerialization.jsonObject(with: data) as? [String: String],
                      let clientSecret = result["clientSecret"] else {
                    completion(nil, NSError(domain: "ParseError", code: -3, userInfo: [NSLocalizedDescriptionKey: "Failed to parse client secret"]))
                    return
                }
                completion(clientSecret, nil)
            } catch {
                completion(nil, error)
            }
        }
    }.resume()
}

注意事项 #

• 后端必须使用Stripe秘钥（sk_开头），禁止在前端硬编码任何秘钥，所有PaymentIntent创建操作必须通过后端完成，这是Stripe的安全要求。
• 验证后端返回的client_secret格式是否为pi_xxx_secret_xxx，避免误传PaymentIntent的ID（pi_xxx）。

内容的提问来源于stack exchange，提问作者Lorenz Flechtenmacher