Stripe Interview Questions 2026

Design Stripe's webhook delivery system. Stripe sends millions of webhooks per day to customer endpoints that can be slow, down, or buggy. Cover: at-least-once delivery guarantees, retry with exponential backoff, ordering guarantees (or lack thereof), how to handle a customer endpoint that is down for 24h, and the dead-letter strategy.

Design Stripe's fraud detection system. For every payment, you must decide accept/decline in under 100ms using hundreds of signals. Cover: feature engineering, real-time ML scoring, rule engine, and how you minimise false positives (declined legitimate payments).

Design Stripe's subscription billing system (Stripe Billing). Customers are charged on recurring intervals (monthly/annual) in different currencies, with proration for plan upgrades. Cover: invoice generation, dunning for failed payments, and SCA (Strong Customer Authentication) compliance.

Design a distributed rate limiter that works across 100 API servers. A user is allowed 1000 requests per minute.

Explain how Stripe handles exactly-once payment processing. A customer clicks "Pay" twice in quick succession. How does Stripe prevent double-charging? Walk through idempotency keys in the API, database-level constraints, and how the client should handle the case where the first request times out.

Explain PCI-DSS compliance requirements for handling card data. What is tokenisation? How does Stripe use it to ensure raw card numbers never touch customer servers? What are the implications for your API design?

Explain the difference between synchronous and asynchronous API design using Stripe as an example. When does a charge complete immediately vs require a webhook? How do you handle the intermediate "pending" state in your database?

Stripe is known for extremely high engineering standards ("move carefully and fix things"). Describe a time you pushed back on a deadline to ensure correctness. Was it the right call?

Explain idempotency keys in a payments API. What specific failure mode do they prevent, and how would you design the storage layer for them so they don't become a bottleneck?

Design a webhook delivery system that must guarantee at-least-once delivery to customer endpoints, with retries and backoff, without letting one slow customer endpoint block delivery to others.

How would you test a payments API endpoint for race conditions where two simultaneous requests might both succeed at deducting from the same account balance?

Design a double-entry ledger system for tracking money movement between accounts. Why is this pattern preferred over simply updating a balance column, especially for auditability?

A Kafka consumer processing payment events crashes and restarts, re-reading the last uncommitted batch. How do you make the payment-processing logic itself idempotent, not just rely on Kafka?

How would you design API key storage so that even if your database is breached, attackers can't use the leaked keys directly?