Stripe PaymentIntent in server-rendered apps (Django/Rails/Laravel): inject the client secret

TL;DR

Django example (Rails/Laravel are the same shape): ` def checkout(request): intent = stripe.PaymentIntent.create( amount=2000, currency='usd', automatic\_payment\_methods={'enabled': True}, ) return render(request, 'checkout.html', { 'client\_secret': intent.client\_secret, 'publishable\_key': PUBLISHABLE\_KEY\_VALUE, }) ` Set the API key from your environment at startup; never hardcode it.

[form id="payment-form"]
  [div id="card-element"][/div]
  [button]Pay[/button]
  [div id="card-errors"][/div]
[/form]
[script src="https://js.stripe.com/v3/"][/script]
[script]
  var stripe = Stripe('{{ publishable_key }}');
  var elements = stripe.elements();
  var card = elements.create('card');
  card.mount('#card-element');
  var form = document.getElementById('payment-form');
  form.addEventListener('submit', async function (e) {
    e.preventDefault();
    var result = await stripe.confirmCardPayment('{{ client_secret }}', {
      payment_method: { card: card },
    });
    if (result.error) {
      document.getElementById('card-errors').textContent = result.error.message;
    } else if (result.paymentIntent.status === 'succeeded') {
      window.location = '/order/complete';
    }
  });
[/script]

Steps

1. Django example (Rails/Laravel are the same shape):

def checkout(request):
 intent = stripe.PaymentIntent.create(
 amount=2000,
 currency='usd',
 automatic_payment_methods={'enabled': True},
 )
 return render(request, 'checkout.html', {
 'client_secret': intent.client_secret,
 'publishable_key': PUBLISHABLE_KEY_VALUE,
 })

2. Set the API key from your environment at startup; never hardcode it.
3. - The client secret is single-use and tied to one intent; rendering it into the page is the intended design.

• Compute the amount server-side from your catalog, not from form input.
• Escape template variables per your framework's defaults so the secret renders as plain text, not HTML.

When to use

You are seeing this: Without an SPA there is no Elements provider tree. Use this skill when you run into "Stripe PaymentIntent in server-rendered apps (Django/Rails/Laravel): inject the client secret".

When not to use

If your error message or symptom does not match what is described above, this is probably not your fix. Search for your exact error text instead of forcing this one to fit.

Versions

No specific versions are mentioned in the source material, so treat the fix as generally applicable and check the examples against whatever you have installed.

Why this happens

The original report does not dig into a root cause. It documents the symptom and the fix that resolved it.

Sources

• https://js.stripe.com/v3/"

Stripe's PaymentIntents flow works with any frontend: the server creates the intent and the client confirms with stripe-js confirmCardPayment (docs.stripe.com/payments/accept-a-payment). Server-rendered apps pass the client_secret through the template; card details never touch the server. Verified against live docs 2026-09-26.