Use a Setup Intent to collect a reusable payment method without charging the customer. Attach it to a customer only after the secure component reports successful setup and your server receives the authoritative event.

Create a Setup Intent

Return the setup ID and short-lived client token to the browser. The browser completes the secure method flow; it never receives the merchant API key.

Attach and reuse

After setup succeeds, attach the returned reusable method to the customer and store only its non-sensitive ID and display metadata. Use that ID when creating an off-session payment or subscription invoice. If the method requires customer action, return the customer to an authenticated recovery flow. Tell the customer what later charges mean, how to remove the method, and how long it is retained. Detach a method with DELETE /api/v1/customers/{id}/payment-methods/{paymentMethodId}. Never expose full account details, verification values, or raw payment credentials.