XF 2.2 Stripe restricted API key

[sub_ubi]

I'd like to use a restricted API key from Stripe on Xenforo. Does anyone know which exact keys Xenforo needs for customers to make a purchase?

Stripe Login | Sign in to the Stripe Dashboard

Sign in to the Stripe Dashboard to manage business payments and operations in your account. Manage payments and refunds, respond to disputes and more.

dashboard.stripe.com

API keys

Use API keys to authenticate API requests.

stripe.com

 

[PaulB]

I'm also curious about this. I wasn't able to find anything in the docs.

 

[Chris D]

I'm actually not sure you can use restricted keys.

It seems as though across the JS and PHP we touch upon these areas:

Read:

• Account
• Invoice

Read/Write:

• Subscription
• Payment Method
• Charge
• Payment Intent
• Product
• Plan
• Customer

The main issue I think is I'm not sure what permission you need to grant for "account". It may be that you get it automatically. Or it may be that it will only work with an account-level key. If that's the case then it's not currently possible to use a restricted key as we require an account object, though we may be able to workaround that requirement.

Hopefully that helps.

 

[PaulB]

The main issue I think is I'm not sure what permission you need to grant for "account".

I tested it out and found that Stripe gives the permission ID in the error logs when it returns a 403 response. Unfortunately, there's no obvious way to map those permission IDs to the settings in the API key GUI, but some searching seemed to indicate rak_connected_account_read--the permission needed for GET account--can be granted by setting "All Connect resources" to "Read". In my testing, that worked, but I'm not sure whether it's possible to set something more restrictive.

 

[Chris D]

It doesn't look like it though of all of the permissions there having that one set to blanket read is probably the least concerning.

 

[PaulB]

Here's what seems to be working for me on a test site. If a checkmark is next to a permission, it means I've verified that the permission is necessary--API calls were failing without it. Permissions without checkmarks mean I didn't verify they were necessary and just assumed they would need to be set.

• All core resources
  • Charges: Write
  • Customers: Write
  • PaymentIntents: Write
  • PaymentMethods: Write
  • Products: Write
• All Billing resources
  • Credit notes: Read
  • Plans: Write
  • Subscriptions: Write
• All Connect Resources: Read

I don't plan to test this on a live site yet. If anyone else tests it, let me know how it goes.