How to save custom fields for attachments

Here is an example that adds a custom media field named Buy Now. This example saves the value of the custom field on the media overlay screen via ajax, as well as the media edit screen (non ajax).

Edit: Added nonce check and sanitization.

/**
 * Add custom field to media.
 */
add_filter( 'attachment_fields_to_edit', 'wpse256463_attachment_fields', 10, 2 );
function wpse256463_attachment_fields( $fields, $post ) {
    $meta = get_post_meta( $post->ID, 'buy_now', true );

    $fields['buy_now'] = [
      'label'        => __( 'Buy Now', 'text-domain' ),
      'input'        => 'text',
      'value'        => $meta,
      'show_in_edit' => true,
      'extra_rows'   => [
        'nonce' => wp_nonce_field(
          'update_attachment_buy_now', // Action.
          'nonce_attachment_buy_now', // Nonce name.
          true, // Output referer?
          false // Echo?
        ),
      ],
    ];

    return $fields;
}

/**
 * Update custom field within media overlay (via ajax).
 */
add_action( 'wp_ajax_save-attachment-compat', 'wpse256463_media_fields', 0, 1 );
function wpse256463_media_fields() {
  $nonce = $_REQUEST['nonce_attachment_buy_now'] ?? false;

  // Bail if the nonce check fails.
  if ( empty( $nonce ) || ! wp_verify_nonce( $nonce, 'update_attachment_buy_now' ) ) {
    return;
  }

  // Bail if the post ID is empty.
  $post_id = intval( $_POST['id'] );
  if ( empty( $post_id ) ) {
    return;
  }

  // Update the post.
  $meta = $_POST['attachments'][ $post_id ]['buy_now'] ?? '';
  $meta = wp_kses_post( $meta );
  update_post_meta( $post_id, 'buy_now', $meta );

  clean_post_cache( $post_id );
}

/**
 * Update media custom field from edit media page (non ajax).
 */
add_action( 'edit_attachment', 'wpse256463_update_attachment_meta', 1 );
function wpse256463_update_attachment_meta( $post_id ) {
  $nonce = $_REQUEST['nonce_attachment_buy_now'] ?? false;

  // Bail if the nonce check fails.
  if ( empty( $nonce ) || ! wp_verify_nonce( $nonce, 'update_attachment_buy_now' ) ) {
    return;
  }

  $buy_now = isset( $_POST['attachments'][ $post_id ]['buy_now'] )
    ? wp_kses_post( $_POST['attachments'][ $post_id ]['buy_now'] )
    : false;

  update_post_meta( $post_id, 'buy_now', $buy_now );

  return;
}