Connect Stripe

Connecting Stripe gives Strent two things:

• A restricted key: a Stripe API key limited to the permissions you choose. With the read-only permissions below, Strent can look up your customers and their subscriptions but cannot change anything in your Stripe account.
• A webhook: your project’s Strent address, which Stripe sends a short message to whenever a customer or subscription changes. Its signing secret lets Strent check that each message really comes from Stripe.

Strent needs both: the messages tell it when something changed, and the key lets it read what changed.

Create a restricted Stripe key

In the Stripe Dashboard, create a restricted API key with only these permissions, leaving every other one at None:

Stripe category	Resource	Permission
Core	Customers	Read
Core	Products	Read
Billing	Subscriptions	Read
Connect	Accounts	Read
Core	Test Clocks (test projects only)	Read
Webhook Endpoints	Webhook Endpoints, Event Destinations	Read

Strent reads event destinations only to check yours, below.

Do not use a full-access secret key. Strent does not need write access to your Stripe account, and it rejects a key that can write Customers, Products, Subscriptions, Test Clocks, or Webhook Endpoints, Event Destinations.

The first successful connection binds the project to that Stripe account. Ordinary key rotation must stay on the same account. A different account requires a new project.

Register the webhook endpoint

1. Open Configuration → Stripe in the Strent project.
2. Copy the project-specific webhook URL.
3. In Stripe Workbench, the developer area of the Stripe Dashboard, create an event destination, Stripe’s name for where it sends webhooks, for events from your account. Choose the Snapshot payload, which sends the whole changed object. Stripe cannot change the payload of an existing destination.
4. Select every required event listed below.
5. Choose Webhook endpoint as the destination type and paste the webhook URL.
6. Copy the destination’s signing secret from Stripe.
7. Save the restricted API key and signing secret in Strent.

Required events:

customer.created
customer.subscription.created
customer.subscription.updated
customer.subscription.deleted
customer.subscription.paused
customer.subscription.resumed
subscription_schedule.created
subscription_schedule.updated
subscription_schedule.canceled
subscription_schedule.completed
subscription_schedule.released
subscription_schedule.aborted

When you save the key and signing secret, Strent refreshes every customer from Stripe automatically: it reads the customers that already exist, so you have nothing to run. The project Overview shows its progress, and it takes a few seconds for an account with few customers. Replacing the key or the signing secret later refreshes every customer again, which also catches changes Strent missed while the connection was broken.

Once the key is saved, Configuration → Stripe and the project Overview check your event destination each time you open them. It reports whether a destination sends to this project’s webhook URL, whether it is enabled, whether it uses the Snapshot payload, and which required events it is missing. When every check passes, it shows Enabled · snapshot · all required events. It also tells you when Strent rejects a delivery whose signature doesn’t match the saved signing secret; check the destination’s deliveries in Stripe before replacing the secret, since anyone who knows the URL can send such a request.

Match the Stripe mode

Test and Live credentials, endpoints, and events are separate in Stripe. Connect them only to a Strent project with the matching mode.

Treat both values as secrets

The restricted API key can read billing data. The webhook signing secret proves that incoming events came from Stripe. Store and rotate both as production credentials, and never place either value in source control or browser code.

Rotate without a gap

Stripe can keep the old value working after it issues a new one, so Strent keeps reading Stripe and verifying events while you switch:

1. In Stripe, rotate the restricted key (Rotate key on the API keys page) or roll the event destination’s signing secret (Roll secret), and delay the old value’s expiration: up to 7 days for a key, up to 24 hours for a signing secret.
2. Before the old value expires, paste the new one in Configuration → Stripe.

Saving it refreshes every customer, as on the first connection. If the old value expires first, Strent rejects your events and cannot read Stripe until you paste the new one; that refresh then catches up on the changes it missed.

Next step

Create an API key →