Helping PlayOn! Sports Scale Their Stripe Payments

PlayOn! Sports has the largest high school sports ticketing solution in the United States. At peak times, such as Friday night football games, they are processing over 300 transactions per second using Stripe’s Charges API.

The Charges API is now considered legacy and Stripe recommends using the Payment Intents API to charge, save, and authenticate cards. PlayOn’s engineers have been working to migrate their codebase to the new Payment Intents API in preparation for a new launch of their ticketing solution.

When you’re processing as many transactions as PlayOn! does, there’s a lot of risk involved in making a change like this. So as their engineers neared completion of development, they worked with Echobind to help audit their front-end and back-end codebases. Echobind provided two of our certified Stripe Professional Architects to perform the audit.

Focus of Audit

After an initial meeting with the PlayOn team to understand their business and concerns, it was agreed the main focus of this audit revolved around the following questions:

• Does their codebase correctly implement the Stripe Payment Intents flow?
• Does their codebase follow Stripe’s security best practices?
• Does their codebase correctly fulfill orders after a successful payment?
• Will their codebase scale with their peak volume of 300+ transactions per second?
• Is their codebase PCI compliant?

Performing the Audit

Over the course of two weeks, our architects traversed PlayOn’s codebases. Our approach was to review the different pieces of the Stripe implementation:

• Payment Element to build the payment user interface in web and mobile applications
• Stripe Webhook handlers for order fulfillment
• Creation of Payment Intent and handling thereafter

Results of the Audit

After reviewing their codebases, we compiled our findings into a final report that we could present to the PlayOn team. We were able to reaffirm the areas where their implementation was sound and also make actionable, meaningful recommendations that will help reduce risk and ensure their launch is successful.

We are excited to see PlayOn’s ticketing solution transition to the new Payment Intents API that will provide a much better user experience for their users and an overall upgrade to their Stripe implementation.