I find the setup as described confusing. What is stopping a customer from just triggering the Stripe call with an invalid code? Presumably, the answer is they c

I find the setup as described confusing. What is stopping a customer from just triggering the Stripe call with an invalid code? Presumably, the answer is they can do it, but after the Stripe call, the order will be rejected at fulfillment time. So, the check is just a preflight, but the real validation comes later. (Or is there a signature involved? Could be, but TFA doesn't specify it.) Either way, you can just do a quick JSON fetch call on the client side as part of client side validation once customers type the code into the box and then pass it along to the server for the final POST.