(Disclosure, I work for Braintree, a competitor to Stripe)
At Braintree we also allow the CVV code to be passed in our API. You are correct that the PCI-DSS explicitly forbids non-issuers from storing the CVV. You are allowed to hold the code temporarily while waiting for the charge to be authorized. This is stated in PCI-DSS Requirement 3.2 (additional formatting is my own):
3.2 Do not store sensitive authentication data after authorization (even if
encrypted). If sensitive authentication data is received, render all data unrecoverable upon completion of the authorization process.
It goes on to define sensitive data as including the CVV:
Sensitive authentication data consists of full track data, card validation code or value, and PIN data. Storage of sensitive authentication data after authorization is prohibited! This data is very valuable to malicious individuals as it allows them to generate counterfeit payment cards and create fraudulent transactions.
What this means is that service providers and merchants are allowed to take the CVV value, they just cannot keep it stored in their database for future use.
In the API you are looking at, the creation of a new vaulted credit card, the CVV is used to run a verification on the card. A verification is a type of authorization that ensures the account is active and able to be charged before we store it. After the verification is returned we discard the CVV. This allows us to give merchants a warning that the card their customer just added will fail the next time they go to use it.