[mmcnickle]

From the article:

> Stripe POSTs at a /tokens API endpoint over https, which means everything is encrypted including the query params

[joosters]

It's still a little unclear: It says that it is a POST, but the URL in the box above contains the card details. Further, the bit of text you quote goes on to say:

> ...including the query params. These params include the card number, expiration date, and CVC

The URL they give as an example is:

https://api.stripe.com/v1/tokens?email=foo%40example.com&pay... &card[exp_month]=4&card[exp_year]=2014&card[name]=foo%40example.com&key=pk_test_6pRNASCoBOKtIshFeQd4XMUh&callback=sjsonp1390180955159&_method=POST

So are these params in the URL, or not?

[mmcnickle]

No, the output in the box is from the web console, which uses the GET-style URL as a concise way of showing POST requests.

[joosters]

Ah, I see. Thanks for the clarification!