Portal
Start Card Update
Create a Stripe SetupIntent for the logged-in portal customer
POST
Start a card update (Stripe SetupIntent)
Requires a portal session (
X-Portal-Session header from magic-link login).client_secret the Payment Element confirms in the browser. Card data goes browser → Stripe directly — no PAN ever reaches Recurso (PCI SAQ-A preserved). After stripe.confirmSetup, finalize with POST /portal/api/payment-method/confirm.
On deployments without Stripe configured this returns 503; UPI-mandate customers should use mandate re-authorization instead.
Example
Start a card update (Stripe SetupIntent)