Create a Stripe PaymentIntent

The cart token from POST /api/v1/cart.

Optional. IP address of the shopper (one IPv4/IPv6, no port, no list). Honoured only together with a valid X-Tenant-Secret; ignored otherwise. Used for rate limits and recorded with form submissions.

Optional here. Server secret of the store: server-to-server only, never from a browser. Enables X-Client-IP.

Optional. The shopper's sid cookie value (8-128 of letters, digits, . _ : -). Recorded on the basket as a SHA-256 hash only (never the raw value), so the order can be checked against the consent in force when it is placed, even when Stripe or PayPal settle it later without a request. Send it on every basket write; an absent header keeps the stored hash, and a malformed one is ignored.

Optional. The vid cookie value, when the shopper has one. Recorded on the basket as a SHA-256 hash only (never the raw value), so the order can be checked against the consent in force when it is placed, even when Stripe or PayPal settle it later without a request. Send it on every basket write; an absent header keeps the stored hash, and a malformed one is ignored.

Optional. The consent cookie value (the consent_token from PUT consent). Recorded on the basket as a SHA-256 hash only (never the raw value), so the order can be checked against the consent in force when it is placed, even when Stripe or PayPal settle it later without a request. Send it on every basket write; an absent header keeps the stored hash, and a malformed one is ignored.

Optional. The GA4 client id from the _ga cookie that the Google tag of the merchant set: its last two numbers (GA1.1.1234567890.1699999999 → 1234567890.1699999999, ^\d{1,10}\.\d{1,10}$). Send it only when the shopper has granted analytics AND advertising. Kept with the basket and the order only while both are in force (removed when either is withdrawn, on erasure, and after its window), and sent to Google Analytics as the client_id of the purchase, so GA4 joins it to the visit. An absent header keeps the stored id; a malformed one is ignored (never a 422).