Direct card payment collection over voice requires PCI DSS compliance measures. For secure payment capture, consider using PCI Pal in combination with Stripe as your payment gateway.
Capabilities
- Payment status lookup: Check the status of existing payments or charges
- Coupon creation: Generate promotional discounts for customers
- Refund processing: Initiate refunds for eligible transactions
- Subscription management: Query subscription status and details
Getting started
Prerequisites
- A Stripe account (Test or Live mode)
- Stripe API keys
- PolyAI project access
Step 1: Obtain API credentials
- Log in to your Stripe Dashboard
- Navigate to Developers → API keys
- Copy your:
- Publishable key: For client-side operations (if needed)
- Secret key: For server-side API calls
- For webhooks (if required), create a webhook endpoint and note the Webhook secret
Step 2: Configure webhook (optional)
If your integration requires real-time payment notifications:- Go to Developers → Webhooks
- Click Add endpoint
- Enter the webhook URL provided by PolyAI
- Select the events you want to receive (e.g.,
payment_intent.succeeded,charge.refunded)
Step 3: Provide credentials to PolyAI
Securely share with your PolyAI team:- API secret key
- Webhook secret (if using webhooks)
- Any specific configuration requirements
Use cases
Payment confirmation
Caller: “Did my payment go through?” Agent: Looks up recent charges by customer email/phone and confirms payment status.Refund requests
Caller: “I’d like a refund for my order.” Agent: Verifies the transaction and initiates the refund through Stripe.Promotional discounts
Caller: “I was promised a discount.” Agent: Creates a one-time coupon in Stripe and provides the code to the caller.Limitations
- Card collection: Direct card number collection requires PCI compliance; use PCI Pal for secure capture
- Dispute handling: Complex dispute resolution requires human intervention
- Account changes: Sensitive account modifications should be verified through additional authentication
Security
- API keys are stored as encrypted secrets
- All API calls use HTTPS
- Webhook signatures are verified to prevent spoofing

