Skip to content

guides

Intended Documentation

Stripe Connector Setup (Beta)

Connect Intended to Stripe. Create a restricted secret API key for refunds and invoices, paste it, and run Test connection. Host-pinned to api.stripe.com with native idempotency. Beta until validated against your live Stripe account.

intermediate3 min readpartial
PartialSource: codeValidated: 2026-07-09

Stripe Connector Setup (Beta)#

Connect Intended to Stripe so approved intents can create refunds and create invoices through the real Stripe REST adapter (packages/execution-engine/src/adapters/stripe.ts). Every financial write is Authority-Token-verified and ESCALATEs for approval under the starter policy, with a native Stripe Idempotency-Key.

This connector is Beta

The adapter is real and covered by hermetic (mocked-HTTP) tests that pass in CI with no live tenant. Live-mode proof against your real Stripe account is pending — treat Stripe as Beta, not GA. See the Capability Truth Matrix.

What the adapter does#

PropertyValue
Actionsstripe.refund.create, stripe.invoice.create
AuthSecret key — Authorization: Bearer <apiToken> (accepts sk_test_ / rk_test_ / sk_live_ / rk_live_)
Pinned hostapi.stripe.com — request URLs are always built from https://api.stripe.com; a stored baseUrl must resolve to api.stripe.com or it fails closed
Test connectionGET /v1/balance

Refunds require a charge or paymentIntent; invoices require a customer.

Provider-side steps#

Secret API key (apiToken, required)#

Prefer a restricted key (rk_…) over a full secret key (sk_…) so it can only do what the two actions need.

  1. In the Stripe Dashboard, go to Developers → API keys → Create restricted key.
  2. Grant only the least-privilege permissions below.
  3. Copy the key value — it is shown once.
  4. Use a test key (rk_test_ / sk_test_) while validating; switch to a live key only when ready.

Least-privilege scope guidance#

  • Matrix scopes for this connector: billing:read, billing:write.
  • On a restricted key, grant:
    • Refunds — Write (for stripe.refund.create).
    • Invoices — Write (for stripe.invoice.create).
    • Balance — Read (for the connection probe).
  • Leave everything else at None. Do not use a full-access secret key when a restricted key covers these actions.

Fields to paste into the connect dialog#

Open Connectors → Connect a system → Stripe → Configure auth:

Field labelKeyRequiredValue
Secret API KeyapiTokenYesrk_live_… / sk_live_… (or a _test_ key while validating)

Credentials are stored per-tenant, AES-256-GCM-encrypted, and never displayed back.

Run Test connection#

  1. Finish the connect wizard to store the credential.
  2. On the connector card, click Test connection.
  3. The adapter calls GET /v1/balance. A green result means the key is valid for your Stripe account.

Next steps#

Stripe Connector Setup (Beta) | Intended