Connecting Stripe

On the Connections screen, connect Stripe in one of two modes. On connect we verify the credentials, then probe per-resource read access so a too-narrow restricted key is caught right away. Credentials are encrypted at rest and never shown again after you connect.

Stripe app (OAuth) vs a pasted key #

Stripe app (OAuth) — click Connect via OAuth and authorize through Stripe. Access is read-only by way of the app’s manifest (there’s no separate read_only scope to request), and the connected account id (acct_…) is stored. The app never writes to Stripe.
Secret / restricted key — click Use a key instead and paste a key (rk_live_… or a secret key). In key mode you should also provide the inbound webhook signing secret.

Webhook signing secret (key mode). When you connect with a pasted key, also set the inbound webhook signing secret (whsec_…). It’s used to verify the events Stripe sends us — it is not the API key. You can set or change it anytime on the Webhooks screen. See Webhooks.

Recommended restricted-key scopes #

The app never writes to Stripe, so a read-only restricted key is enough. Grant Read access to the resources we sync:

Resource	Access
Customers	Read
Products	Read
Prices	Read
Subscriptions	Read
Invoices	Read

On connect, the app probes each resource so a key that’s missing one of these is flagged immediately in the Object access panel. Webhook verification uses the signing secret, not this key.

Testing and disconnecting #

Test re-verifies the stored credentials and re-runs the access probe, reporting whether the account is in live mode and which resources are reachable.
Disconnect removes the connection and its stored credentials.

GET    /v1/connections
GET    /v1/connections/stripe
GET    /v1/connections/stripe/oauth-url
POST   /v1/connections/stripe/key
POST   /v1/connections/stripe/test
PUT    /v1/connections/stripe/webhook-secret
DELETE /v1/connections/stripe

The OAuth flow returns to /api/connections/stripe/callback. After connecting, the card shows the webhook URL to register in Stripe.

Where to next #

Webhooks — register the inbound webhook URL and set the signing secret.
Connecting HubSpot — connect the other side.