Upgrading your Stripe plugin security

Ben SmithSep 19, 2024

Source: Stripe
Published: Sep 19, 2024
Added to Yomu: Aug 28, 2026

Summary

Stripe plugins commonly authenticate merchants’ accounts with unrestricted secret API keys, but those keys grant full access and can expose payment, customer, and subscription operations if mishandled or compromised. The post presents restricted API keys (RAK) and OAuth 2.0 as zero-trust alternatives that apply identity verification and least-privilege permissions to third-party integrations. RAKs let developers define narrowly scoped permissions, while OAuth 2.0 uses Stripe’s interface for tokenized, one-click authorization and lets merchants revoke access without sharing a secret key. For existing plugins, it outlines migration through Stripe Apps, Stripe Connect, or manual RAK setup, and states that Stripe will require RAK or OAuth 2.0 authentication from October 29, 2024, with possible fees for merchants still using full-access keys after June 2025.

Context

Plugins often require merchants to copy unrestricted secret API keys into third-party platforms. Because these keys grant full access to a Stripe account, mishandling or compromise could enable unauthorized transactions, data breaches, and financial losses. The post also describes Stripe’s requirement for plugin authentication through restricted API keys or OAuth 2.0 beginning October 29, 2024.

Approach / What changed

Replace unrestricted secret keys with restricted API keys or OAuth 2.0. RAKs limit a plugin to explicitly defined permissions, while OAuth 2.0 provides tokenized, one-click authorization through Stripe’s interface and allows merchants to revoke access. Existing plugins can be migrated to Stripe Apps, Stripe Connect, or a manually configured RAK.

Takeaways

Unrestricted secret API keys provide full access to a merchant’s Stripe account, so exposure or compromise can enable unauthorized transactions and data breaches.
Restricted API keys enforce least privilege by limiting a plugin to defined permissions, such as read-only access to customer data.
OAuth 2.0 issues a token with the necessary permissions through Stripe’s authorization interface, avoiding secret-key sharing and allowing merchants to revoke access.

Authentication Privacy REST APIs

Read original post

Upgrading your Stripe plugin security

Ben SmithSep 19, 2024

Source: Stripe
Published: Sep 19, 2024
Added to Yomu: Aug 28, 2026

Summary

Context

Approach / What changed

Takeaways

Unrestricted secret API keys provide full access to a merchant’s Stripe account, so exposure or compromise can enable unauthorized transactions and data breaches.
Restricted API keys enforce least privilege by limiting a plugin to defined permissions, such as read-only access to customer data.
OAuth 2.0 issues a token with the necessary permissions through Stripe’s authorization interface, avoiding secret-key sharing and allowing merchants to revoke access.

Authentication Privacy REST APIs

Read original post

Related reading

Stripe · Feb 21, 2025
Securing Stripe API Keys in AWS with automatic rotation
The article presents a production-grade approach to securing Stripe API keys in AWS, motivated by the risks and operational limits of basic secret storage for payment processing. It compares AWS Parameter Store with Secrets Manager, emphasizing built-in rotation, CloudTrail audit trails, IAM integration, larger secrets, and cross-account access despite higher cost. The implementation uses environment-specific secret paths, tags, and IAM conditions to isolate development, staging, and production credentials, with separate rotation schedules. For zero-downtime rotation, applications refresh cached credentials after authentication failures while both old and new keys remain valid during a transition. The design also covers CloudWatch monitoring, emergency rotation procedures, cross-region replication, region-specific schedules, and cost considerations, concluding that ongoing review is necessary for secure and reliable payment operations.
James Beswick
Stripe · Nov 27, 2024
Data access patterns for simple Stripe integrations
The article examines how applications should store and access product data in simple Stripe integrations as requirements for security, performance, and scalability evolve. It compares using Stripe’s built-in product fields with a separate database, while explaining that publishable API keys cannot retrieve product details and that secret or restricted keys must remain server-side. A web backend or serverless function can proxy requests securely, while CloudFront caching reduces repeated calls and latency but requires an appropriate refresh cadence. For richer metadata, inventory, variants, or custom attributes, the article describes combining DynamoDB with Lambda and Stripe, using Event Destinations or webhooks to synchronize changes and weighing that flexibility against database overhead.
Ben Smith
Stripe · Jul 3, 2025
Stripe for marketplaces: Mapping commercial relationships in code
The post presents a guide to mapping marketplace relationships among buyers, sellers, and the platform in Stripe Connect, focusing on payment processing, seller onboarding, payouts, fees, refunds, and disputes. It uses Greens & Dairy Mart, a fictitious farm marketplace, to show how an unlicensed marketplace can manage payments with Stripe while meeting applicable regulatory requirements. Using the Account API, connected accounts, controller settings, KYC links, capabilities, Payment Intents, transfers, and webhooks, the implementation encodes responsibilities and money movements. Greens & Dairy Mart charges customers after farmers confirm dispatch, pays farmers after delivery confirmation, and retains 15% of the final price. The guide also shows refund and transfer reversal flows, including recovering disputed amounts from a seller’s balance, and concludes that Connect APIs can automate complex marketplace contracts and financial interactions.
Ana Andres
Stripe · Feb 6, 2025
Building rock-solid Stripe integrations: A developer's guide to success
The guide presents ten practices for building production-ready Stripe integrations, covering payment forms, subscriptions, and operational concerns. It recommends verifying webhook signatures with the Stripe-Signature header and endpoint secret, recording event IDs for idempotency, and returning a fast 2xx response while processing asynchronously. Test and live API keys, webhook endpoints, logs, and monitoring should remain separate, while error handling should distinguish card, request, and API failures and use exponential backoff for retries. The guide also recommends testing successful, declined, insufficient-funds, and 3DS scenarios with Stripe test cards, alongside simulated webhook events. Its conclusion emphasizes edge-case planning, logging, monitoring, and ongoing review as foundations for reliable, secure payment processing that can scale with business needs.
James Beswick