--- title: "Stripe" description: "Global payments and financial infrastructure platform building sophisticated technology for online commerce" --- # Stripe > Global payments and financial infrastructure platform building sophisticated technology for online commerce ## Articles ### [Upgrading your Stripe plugin security](https://yomu.fyi/post/upgrading-your-stripe-plugin-security.md) - Company: [Stripe](https://yomu.fyi/company/stripe.md) - Author: Ben Smith - Published: Sep 19, 2024 - Type: Problem & solution Stripe plugins commonly authenticate merchants’ accounts with unrestricted secret API keys, but those keys grant full access and can expose payment, customer, and subscription operations if mishandled or compromised. The post presents restricted API keys (RAK) and OAuth 2.0 as zero-trust alternatives that apply identity verification and least-privilege permissions to third-party integrations. RAKs let developers define narrowly scoped permissions, while OAuth 2.0 uses Stripe’s interface for tokenized, one-click authorization and lets merchants revoke access without sharing a secret key. For existing plugins, it outlines migration through Stripe Apps, Stripe Connect, or manual RAK setup, and states that Stripe will require RAK or OAuth 2.0 authentication from October 29, 2024, with possible fees for merchants still using full-access keys after June 2025. ### [Avoiding test mode tangles with Stripe Sandboxes](https://yomu.fyi/post/avoiding-test-mode-tangles-with-stripe-sandboxes.md) - Company: [Stripe](https://yomu.fyi/company/stripe.md) - Author: Ben Smith - Published: Sep 16, 2024 - Type: Tutorial Stripe integrations can become difficult to test when an account has only one test mode, because unrelated work can interfere and sensitive configuration must remain protected. The post presents Stripe Sandboxes as separate testing areas and shows a Node.js Express application authenticating with a sandbox secret key stored in a .env environment variable. It creates payment intents through /create-payment-intent and retrieves account details through /account, then uses Jest and supertest to verify the sandbox identity, including the expected display name dev-sandbox. A GitHub Actions workflow injects STRIPE\_API\_KEY from repository secrets, installs dependencies, and runs tests on pushes to the main branch, while .gitignore excludes environment files. The conclusion is that isolated sandboxes and automated checks reduce test tangles and help prevent calls to the wrong environment. ### [Advanced error handling patterns for Stripe enterprise developers](https://yomu.fyi/post/advanced-error-handling-patterns-for-stripe-enterprise-developers.md) - Company: [Stripe](https://yomu.fyi/company/stripe.md) - Author: Ben Smith - Published: Sep 3, 2024 - Type: Tutorial The post presents advanced error-handling patterns for Stripe integrations that face high request volumes, temporary API slowdowns, connectivity problems, and webhook delivery failures. It uses Stripe Workbench to inspect account-level API activity, traffic spikes, error rates, API versions, and webhook activity; one example links a 429 response to a scheduled job that created usage records across thousands of accounts simultaneously. The implementation combines request spacing with Limiter, a p-queue concurrency cap of five, and a token bucket configured for 100 tokens per 60 seconds. Stripe’s stated limits are 100 read and 100 write operations per second in live mode and 25 of each in test mode, with stricter limits for some resources. The reported before-and-after results show the combined controls processing high API-call volume within those limits, reducing errors and producing more predictable interaction. ### [Simple error handling strategies with Stripe Workbench](https://yomu.fyi/post/simple-error-handling-strategies-with-stripe-workbench.md) - Company: [Stripe](https://yomu.fyi/company/stripe.md) - Author: Ben Smith - Published: Sep 2, 2024 - Type: Tutorial Stripe Workbench addresses the difficulty of finding and understanding errors produced by Stripe API invocations. It gives developers a view of recent errors, groups repeated failures, shows their frequency, and links summaries to request logs and actionable resolution guidance. The article describes Stripe error categories such as StripeCardError, StripeInvalidRequestError, and StripeConnectionError, then demonstrates Node.js try/catch handling that branches on the error type. It also covers webhook responses for payment\_intent.payment\_failed events, including retrieving event.data.object.last\_payment\_error, and explains how objects such as PaymentIntents, Setup Intents, Invoices, Setup Attempts, Payouts, and Refunds retain failure information for later inspection. Combined, these mechanisms support targeted responses, troubleshooting through detailed request and response data, and more reliable Stripe integrations. ### [Stripe Developer Digest (August 2024): Workbench is now available to everyone](https://yomu.fyi/post/stripe-developer-digest-august-2024-workbench-is-now-available-to-ever.md) - Company: [Stripe](https://yomu.fyi/company/stripe.md) - Author: Stripe Team - Published: Aug 30, 2024 - Type: Announcement Stripe’s August 2024 developer update announces that Workbench is available to everyone across every Dashboard surface, addressing developers’ request for in-context guidance and debugging tools during API integration work. Workbench is a developer home in the Dashboard that provides an at-a-glance view of integration behavior, lets users inspect API and event history, prototype integrations, and receive critical account alerts. As developers build, it highlights errors, helps resolve them, and recommends ways to improve integration efficiency; it can be opened with a single keystroke. The update also places Sandboxes and Event Destinations in public beta, expands Tap to Pay on iPhone with Stripe to seven countries, and notes community resources for Stripe Tax, the Stripe CLI, Payment Links, and related integrations. ### [Bringing your Stripe objects to life with Workbench](https://yomu.fyi/post/bringing-your-stripe-objects-to-life-with-workbench.md) - Company: [Stripe](https://yomu.fyi/company/stripe.md) - Author: Ben Smith - Published: Aug 29, 2024 - Type: Tutorial The post demonstrates how Stripe Workbench’s Inspector can be used to examine a PaymentIntent throughout its lifecycle and diagnose payment workflow issues. It maps states including requires\_payment\_method, processing, requires\_action, succeeded, and canceled, showing how the status property changes as inputs and decisions move the object through a state machine. The walkthrough creates and confirms test PaymentIntents with Stripe Shell commands, including a 3DS-required card that produces a requires\_action state and a use\_stripe\_sdk next\_action. It also describes reacting to state changes through webhook endpoints or Amazon EventBridge, using the Inspector to identify friction such as PaymentIntents stalled at requires\_action and to debug abandoned payments. ### [Debugging your Stripe Invoicing integration with Workbench](https://yomu.fyi/post/debugging-your-stripe-invoicing-integration-with-workbench.md) - Company: [Stripe](https://yomu.fyi/company/stripe.md) - Author: David Edoh-Bedi - Published: Aug 29, 2024 - Type: Tutorial The post demonstrates how to debug and fix Stripe Invoicing integration errors with Workbench, a context-aware tool available throughout the Stripe Dashboard. It uses the Overview and Errors tabs to locate a recent parameter\_missing error, then examines the failed Invoice create request and identifies the missing Customer object that prevented invoice creation. The Shell and API Explorer let developers list customers, supply a Customer ID, construct and run the corrected create command, and generate an SDK request from the configured fields. Workbench’s Inspector then exposes the invoice’s JSON data map, logs, and lifecycle events; the example confirms successful payment for a zero-dollar invoice and explains that non-zero charges require Invoice Items tied to products and prices. ### [Peeking under the hood of Stripe Invoicing](https://yomu.fyi/post/peeking-under-the-hood-of-stripe-invoicing.md) - Company: [Stripe](https://yomu.fyi/company/stripe.md) - Author: David Edoh-Bedi - Published: Aug 26, 2024 - Type: Tutorial Stripe Invoicing’s no-code workflow hides the API calls and invoice state transitions that developers may need to inspect when debugging payment failures. Using Stripe Workbench’s Inspector, Logs, and Events tabs, the walkthrough maps object hierarchies, requests, event payloads, and previous\_attributes across an invoice lifecycle. Creating an invoice in the Dashboard produces a draft Invoice, a separate Invoice Item, an automatically generated Invoice Line Item, and related creation or update events. Sending it creates a Payment Intent and finalizes the invoice from draft to open; charging captures the Payment Intent, creates a Charge, and changes the invoice to paid. Draft invoices can be deleted, while open invoices can be voided, preserving the record and canceling the Payment Intent, and the same Workbench method can be applied to other Stripe API areas. ### [Observing immediate versus delayed payments with Stripe Workbench](https://yomu.fyi/post/observing-immediate-versus-delayed-payments-with-stripe-workbench.md) - Company: [Stripe](https://yomu.fyi/company/stripe.md) - Author: Cecil Phillip - Published: Aug 23, 2024 - Type: Tutorial Stripe payment methods differ in how quickly they confirm attempted payments, with cards reporting status immediately and bank debits, bank transfers, and cash-based vouchers requiring additional processing time. The post uses Stripe Workbench and its in-browser CLI shell to create Checkout sessions in test mode, submit card and ACH Direct Debit payments, and inspect emitted events. For cards, charge.succeeded and payment\_intent.succeeded signal successful payment, while integration code must inspect checkout.session.completed payment\_status rather than confuse it with the session status. With delayed methods, checkout.session.completed can show unpaid before checkout.session.async\_payment\_succeeded or checkout.session.async\_payment\_failed arrives; the former changes payment\_status to paid, and production processing can take days. [Newer posts](https://yomu.fyi/company/stripe/page/5.md)