Connect Stripe

A restricted key, and nothing else

Stripe has no install screen, so velur asks you for a key instead. Create a restricted key in Stripe with read access only, then paste it into Sources. velur stores it sealed and reads subscriptions with it.

velur accepts a restricted key, rk_, and refuses a secret key, sk_, before Stripe is ever asked about it. A secret key can move money. That is the whole reason for the rule.

What Stripe is read for

Stripe is where the subscription side of the brief comes from: MRR at the end of the day, and the subscriptions behind it. Orders and refunds come from Shopify.

Replacing or removing the key

A new key replaces the old one at once. Disconnecting the source deletes the stored key. If you revoke the key in Stripe, velur's next sync fails and the source goes stale, which holds the brief rather than reporting a day it could not read.

DRAFT: which permissions to tick in Stripe

The permissions on a restricted key are chosen in Stripe's own dashboard, and velur cannot generate that list from anything in its own configuration. The exact set to tick is not written down here yet, and will not be until it can be stated from one source rather than three.