Larkspur APIAPI
Payments, as an API.
Idempotent RefundsAn integration leadPayments take an idempotency key. Refunds do not, so a timeout on our side means we genuinely cannot tell whether the customer has been refunded once or twice without going to look.Dmitri Novak That is an inconsistency in our API rather than a gap in yours, and refunds are the worse half to have left out. Checking whether anything downstream assumes refunds are unkeyed before we commit to a date.A Test ClockA platform engineerWe bill monthly and cannot test a renewal without waiting a month or faking our own dates, which means the retry path has never been tested end to end. That is the path that handles money.Ada Whitfield The untested path being the one that handles money is a fair way to put it, and it is our fault it is hard to reach. Planned: a clock you can move forward in the sandbox, which advances renewals, retries and expiries together rather than one at a time.Store Card NumbersA customerWe would like to hold the full card number so we can move our customers to another provider later without asking them to enter it again.Carmen Ruiz No, and this one is not a judgement call. Holding full card numbers puts you into the highest level of PCI obligation, which means an annual on-site assessment and a quarterly scan, and it means a breach at your end is a card breach rather than a bad afternoon. Almost nobody who asks for this wants what it actually costs. The real need underneath it is portability, and that is fair. Larkspur supports a network token migration: your provider and ours exchange tokens directly, your customers enter nothing, and no card number ever sits in your database. Ask us and we will start one.Replay a WebhookAn integration leadOur endpoint was down for about forty minutes during a deploy. Those events are simply gone and we had to reconcile by hand against a CSV.Ada Whitfield Reconciling by hand after a routine deploy is not a reasonable outcome. Building the replay.