Support for Stripe Restricted API Keys?
-
Does this plugin support for Stripe Restricted API Keys?
* https://docs.stripe.com/keys-best-practices#limit-access
For security reasons, it’s important to me that my server authenticates to Stripe using a Restricted API Key. This would, for example, ensure that if my server is compromised, then the attacker wouldn’t be able to change my Stripe account’s information — such as the payout address (allowing them to steal all my funds).
Does this plugin support authentication with the Stripe API using Restricted API Keys?
-
Fantastic news, thanks!
We highly recommend using Stripe Connect to set up your payment gateway, as it offers a seamless integration and handles most of the process automatically.
While it’s true that it’s a simper UX, Stripe Connect is less secure. The OAuth flow implemented by Stripe requires your users to leak the OAuth Access Tokens (with read/write access to their Stripe merchant account) to a third party.
This is why using a Restricted API Key is more secure than using Stripe Connect.
Since this is not the standard process please be sure while creating your API key you provide the necessary permissions for all required resources listed here: https://tinyurl.com/294afvrv.
Thanks, but that screenshot doesn’t list all of the permissions. Can you please document the minimum permissions in text in your documentation?
Edit: if you click on the image, then it does show the full page with all the permissions. But I would still appreciate it if it was typed-out and added to your documentation as a new KB article titled “What are the minimum permissions for Restricted API Keys?”
Thank you
Here’s a transcription of the screenshot showing the minimum permissions required for this plugin’s Restricted API Key:
<h2>Core</h2>
Apple Pay Domains: Write
Balance: Read
Balance transaction sources: Read
Balance Transfers: Write
Test clocks: Unintelligible
Charges: Write
Confirmation token: None
Confirmation token (client): None
Customers: Write
Customer session: None
Disputes: Write
Events: Read
Ephemeral keys: None
Files: Write
Funding Instructions: None
Payment Intents: Write
Payment Methods: Write
Payment Method Domains: Write
Payouts: Write
Products: Write
Shipping Rates: Write
Setup Intents: Write
Sources: Write
Tokens: None<h2>Checkout</h2>
Checkout: Write<h2>Billing</h2>
Coupons: Write
Promotion Codes: Write
Credit notes: Write
Customer portal: Write
Invoices: Write
Prices: Write
Subscriptions: Write
Quote: Write
Tax IDs: Write
Tax Rates: Write
Usage Records: Write
Meters: Write
Meter Events: Write
Meter Event Adjustments: Write
Features: Write
Entitlements: Read
Credit grants: Write
Credit balances: Read
Alerts: : Write<h2>Connect</h2>
(None for all)<h2>Orders</h2>
Orders: Write
SKUs: Write<h2>Issuing</h2>
(None for all)<h2>Reporting</h2>
(Read for all)<h2>Sigma</h2>
(None for all)<h2>Financial Connections</h2>
(None for all)<h2>Identity</h2>
(None for all)<h2>All webhook</h2>
(Write for all)<h2>Stripe CLI permissions</h2>
(None for all)<h2>Payment Links</h2>
Payment Links: Write<h2>Terminal</h2>
Configurations: Write
Locations: Write
Readers: Write
Connection Tokens: Write<h2>Tax</h2>
Tax Calculations and Transactions: Write
Tax Settings and Registrations: Write<h2>Radar</h2>
(None for all)<h2>Climate</h2>
(None for all)Are you sure that this plugin requires Write permission to Core -> Payouts?
* https://docs.stripe.com/api/payouts/create
* https://webdesigneracademy.com/my-stripe-account-was-hacked-and-stripe-said-i-have-to-repay-70k/That seems like the most important permission to be None, no?
The topic ‘Support for Stripe Restricted API Keys?’ is closed to new replies.
